ACTIVELY EXPLOITED
CVE-2022-29499: Mitel MiVoice Connect Data Validation Vulnerability
| Vendor | Mitel |
|---|---|
| Product | MiVoice Connect |
| Actively exploited | Yes |
| Added to CISA KEV | 27 Jun 2022 |
| CISA federal deadline | 18 Jul 2022 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-20 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
SOURCES
Other Mitel flaws
- CVE-2024-41710: Mitel SIP Phones Argument Injection Vulnerability
- CVE-2024-55550: Mitel MiCollab Path Traversal Vulnerability
- CVE-2024-41713: Mitel MiCollab Path Traversal Vulnerability
- CVE-2022-41223: Mitel MiVoice Connect Code Injection Vulnerability
- CVE-2022-40765: Mitel MiVoice Connect Command Injection Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.