CVE-2022-29499

mitel mivoice connect

Published 26 Apr 2022 · updated 6 Aug 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 27 Jun 2022, with a remediation deadline of 18 Jul 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

References

www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499 · US Government Resource