Mitel MiVoice Connect Data Validation Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 25, 2022 · Catalog

   Detected

   The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

2. Jun 27, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jul 18, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Aug 5, 2026 · Catalog

   Updated

   The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

Affected

• cpe mitel/mivoice connectversion unspecified
• vendor Mitel MiVoice Connectversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2022-29499

  The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.

  cisa.gov
• CVE.orgVulnerability recordCVE-2022-29499

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2022-29499

  30-day exploitation probability 55.2%

  first.org
• NIST NVDVulnerability recordCVE-2022-29499

  The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · mitel.com