CVE-2022-29499: Mitel MiVoice Connect Data Validation Vulnerability
CVE-2022-29499 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-06-27
The Service Appliance component in Mitel MiVoice Connect (SA 100, SA 400, and Virtual SA) contains a data validation vulnerability. This flaw allows a remote, unauthenticated attacker to execute arbitrary code on the affected device.
Yes. CVE-2022-29499 is known to be exploited in the wild, first recorded on 27 June 2022. Treat it as urgent.
How severe is CVE-2022-29499?
Critical severity, with a CVSS score of 9.8, published 27 June 2022.
Which products and versions are affected?
Mitel MiVoice Connect Service Appliance SA 100 through 19.2 SP3; Mitel MiVoice Connect Service Appliance SA 400 through 19.2 SP3; Mitel MiVoice Connect Virtual Service Appliance through 19.2 SP3.
Is there a fix for CVE-2022-29499?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-29499 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2022-29499?
Check whether you run Mitel MiVoice Connect. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Mitel MiVoice Connect Service Appliance SA 100 through 19.2 SP3
Mitel MiVoice Connect Service Appliance SA 400 through 19.2 SP3
Mitel MiVoice Connect Virtual Service Appliance through 19.2 SP3
Timeline
2022-04-25: disclosed: NVD Published Date
2022-06-27: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2022-06-27: exploited: Reported as exploited in the wild