CVE-2022-41223: Mitel MiVoice Connect Code Injection Vulnerability
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
Other sources
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mitel MiVoice Connect Director database componentto a version that resolves this vulnerability.Fixed in 19.3 (22.22.6100.0) - Compensating control
Limit Director component access to trusted internal users/systems only (authenticated attacker with internal network access is able to execute code in application context).
Event History
Frequently Asked Questions
What is CVE-2022-41223?
CVE-2022-41223 is a code injection vulnerability in Mitel MiVoice Connect, which allows an authenticated attacker to execute code within the application.
How can an attacker exploit CVE-2022-41223?
An attacker with internal network access can exploit CVE-2022-41223 by executing code within the context of the Mitel MiVoice Connect application.
Who is affected by CVE-2022-41223?
Users of Mitel MiVoice Connect are affected by CVE-2022-41223.
Is authentication required to exploit CVE-2022-41223?
Yes, authentication is required for an attacker to exploit CVE-2022-41223.
How can I fix CVE-2022-41223?
Mitel has released a security advisory (22-0008) with mitigation instructions for CVE-2022-41223. Please refer to their advisory for the fix.