Actively exploited in the wild
Mitel MiVoice Connect Data Validation Vulnerability
Mitel - MiVoice Connect · Listed in the CISA KEV since 2022-06-27. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-29499
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution due to incorrect data validation. Affected appliances are SA 100, SA 400, and Virtual SA.
Risk Assessment
A remote attacker could execute arbitrary code on the device, potentially leading to full system compromise and control over communications.
Recommendation
Apply available patches or update to a fixed version. Restrict access to the appliances from trusted networks.
Original NVD description (English source)
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.