CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2022-29499

CVSS 9.8v3.1pub. 2022-04-26upd. 2026-08-06

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Mitel Mivoice Connect

    APP
    Mitel
    ≤ 22.20.2300.0

CISA KEV — detailsi

Vendori
Mitel
Producti
MiVoice Connect
Added to KEVi
June 27, 2022
Remediation deadline (US Federal)i
July 18, 2022(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 18 lipca 2022
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-32748CRITICAL9.8PL ✓same product

Mitel MiVoice Connect — obejście uwierzytelniania w komponencie Linux DVS

CVE-2023-31458CRITICAL9.8PL ✓same product

Mitel MiVoice Connect – pominięcie uwierzytelnienia w Edge Gateway

CVE-2023-31457CRITICAL9.8PL ✓same product

Mitel MiVoice Connect — ominięcie autoryzacji w komponencie Headquarters

CVE-2020-10211CRITICAL9.8PL ✓same product

RCE w komponencie UCB Mitel MiVoice Connect — brak walidacji parametrów URL

CVE-2023-39289HIGH7.5same product

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could a...