Actively exploited · Published Apr 26, 2022 · Assigned by mitre

CVE-2022-29499

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity improper input validation in MiVoice Connect from Mitel. Attackers are actively exploiting it in the wild (listed by CISA on June 27, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 55.2% (higher than 99.0% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)55.2%top 1.0% of all CVEs

Exploited in the wildYesCISA KEV since Jun 27, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jul 18, 2022.

Official description

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002 x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499 government-resource