CVE-2022-29499: Mitel MiVoice Connect Data Validation Vulnerability
Published Apr 26, 2022
·Updated
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
Other sources
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
— CISA
Affected Software
2 affected components
Mitel MiVoice Connect
Mitel MiVoice Connect<=22.20.2300.0
Event History
Apr 26, 2022
CVE Published
via MITRE·01:13 AM
Data Sourced
via MITRE·01:13 AM
Description
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Jun 27, 2022
Known Exploited
via CISA·12:00 AM
Known Ransomware
via CISA·12:00 AM
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-29499.
2
What is the severity of CVE-2022-29499?
The severity of CVE-2022-29499 is critical with a score of 9.8.
3
How does CVE-2022-29499 affect Mitel MiVoice Connect?
CVE-2022-29499 affects Mitel MiVoice Connect through version 19.2 SP3.
4
How does the vulnerability in Mitel MiVoice Connect occur?
The vulnerability in Mitel MiVoice Connect occurs due to incorrect data validation in the Service Appliance component.
5
How can I fix the vulnerability in Mitel MiVoice Connect?
To fix the vulnerability in Mitel MiVoice Connect, it is recommended to apply the necessary patches provided by Mitel.