TRIADA
Back to live map

CVE-2022-29499

KEVRansomware UseMitel MiVoice Connect Data Validation Vulnerability
Description

The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PublishedApr 26, 2022
Last modifiedAug 6, 2026
Added to KEVJun 27, 2022
Remediation dueJul 18, 2022
References
0 recent articles mention this CVE
    95
    Risk assessment · Critical

    Actively exploited and used by ransomware crews. Patch immediately.

    Exploitation
    Confirmed in the wild (CISA KEV)
    Federal remediation deadline
    Overdue by 1561 days
    Ransomware
    Used in known ransomware campaigns
    CVSS
    9.8 CRITICAL
    EPSS (30-day exploit probability)
    55.2% · top 1% of all CVEs
    Weakness
    CWE-20
    Attack vector
    Network, remotely reachable
    Preconditions
    No privileges and no user interaction
    Recommended actions
    1. 1.Apply updates per vendor instructions.
    2. 2.Treat as emergency change: patch or isolate internet-facing instances first.
    3. 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
    4. 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
    5. 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.

    Assessment is derived automatically from the live signals above; verify against your own asset inventory.