CVE-2022-41223

CVE-2022-41223 is a medium-severity (CVSS 6.8) vulnerability in Mitel MiVoice Connect. CISA added it to the Known Exploited Vulnerabilities catalog on February 21, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 14, 2023. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Mitel has 7 vulnerabilities in the KEV catalog, 5 of them linked to ransomware.

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• https://www.mitel.com/support/security-advisories
• https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008
• https://www.mitel.com/support/security-advisories
• https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41223