CVE-2022-29499
Last modified
CVE-2022-29499 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.. CISA has confirmed active exploitation in the wild. EPSS estimates a 55.40% chance of exploitation in the next 30 days.
Description
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mitel | Mivoice Connect | <= 22.20.2300.0 |
References
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2022-29499?
How severe is CVE-2022-29499?
How do I fix CVE-2022-29499?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-29492Improper Input Validation vulnerability in the handling of a…7.5
- CVE-2022-29493Uncaught exception in webserver for the Integrated BMC in so…4.9
- CVE-2022-29494Improper input validation in firmware for OpenBMC in some In…6.5
- CVE-2022-29495Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos P…4.3
- CVE-2022-29496A stack-based buffer overflow vulnerability exists in the Bl…9.8
- CVE-2022-29498Blazer before 2.6.0 allows SQL Injection. In certain circums…7.5
- CVE-2022-2950 Altair HyperView Player versions 2021.1.0.27 and prior ar…7.8
- CVE-2022-29500SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access C…8.8
- CVE-2022-29501SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access C…8.8
- CVE-2022-29502SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access C…9.8
- CVE-2022-29503A memory corruption vulnerability exists in the libpthread l…9.8
- CVE-2022-29504Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2022-29499?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST