cyfenced.com →

[ CVE-2022-29499 · Published 26 Apr 2022 ]

Mitel MiVoice Connect Data Validation Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 55%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-06-27
  • Known to be used in ransomware campaigns
  • EPSS: 55% chance of exploitation in the next 30 days (higher than 99% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

CISA: The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 18 Jul 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References