by Kastro
Paper/Archive/CVE-2022-29499

CVE-2022-29499

Mitel MiVoice Connect — Mitel MiVoice Connect Data Validation Vulnerability

KEV · due 18 Julransomware useEPSS 55%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.0.990 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refmitel.com/support/security-advisories/mitel-product-security-advisory-22-0002refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499kevcisa.gov/known-exploited-vulnerabilities-catalog