CVE DatabaseCVE-2022-29499

Updated 2026-08-06한국어 권고문 →

CVE-2022-294999.8/CRITICALCISA KEVCWE-20CWE-20

Mitel MiVoice Connect Service Appliance Remote Code Execution Vulnerability Advisory (CVE-2022-29499)

⚡ Jump to Patch

Affected Vendors

mitel

Affected Components

mivoice connect, service appliance

Published Date

2022-04-26

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

55.2%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Mitel MiVoice Connect through 19.2 SP3 Service Appliances (SA 100, SA 400, and Virtual SA).

Impact

Unauthenticated remote attackers can exploit incorrect data validation to execute arbitrary code and gain full control over the affected appliance.

Mitigation

Apply the official security patches immediately and restrict access to the management interfaces from the public internet.

Affected Products & Version Scope

Mitel MiVoice Connect versions up to and including 19.2 SP3 on Service Appliances SA 100, SA 400, and Virtual SA.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Refer to Mitel Product Security Advisory 22-0002 to obtain and apply the official security update. Below is an administrative command example to verify the current version and apply the patch.

bash

# Check the current Mitel release version
cat /etc/mitel-release

# Execute the official patch deployment script (as recommended by the vendor)
curl -sSL https://support.mitel.com/updates/apply-patch-22-0002.sh | bash

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to the appliance's web interface using firewall rules or reverse proxy configurations to allow only trusted internal IP addresses.

nginx

# Nginx configuration snippet to restrict access to sensitive endpoints
server {
    listen 443 ssl;
    server_name mitel.local;

    # Restrict access to internal service appliance endpoints
    location /internal-api/ {
        allow 10.0.0.0/8;
        allow 172.16.0.0/12;
        deny all;
    }
}

3. Log Audit & IoC Verification Commands

Run the following commands to inspect web server logs for potential exploitation attempts and identify unauthorized active processes.

bash

# Scan web access logs for common command injection payloads
grep -Ei '(sh|bash|curl|wget|python|perl|eval)' /var/log/httpd/access_log

# Audit running processes spawned by the web server user
ps auxf | grep -E '(apache|nginx|www-data)' | grep -v 'grep'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active in-the-wild exploitation, immediately isolate affected Mitel Service Appliances from the public internet and apply the vendor security patch.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-29499) exists in the Service Appliance component of Mitel MiVoice Connect. It is caused by insufficient input validation (CWE-20) of user-supplied data passed to internal system scripts. Due to this flaw, the application fails to properly sanitize input parameters, allowing remote attackers to inject and execute arbitrary operating system commands under the context of the web server process.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to a vulnerable endpoint on the Service Appliance. Because the input is directly concatenated into a system command execution shell without proper validation, the injected payload executes with elevated privileges. In-the-wild exploitation has shown attackers leveraging this vulnerability to establish reverse shells, download malicious tools, and establish persistence within the target network.

3. Infrastructure & Business Impact

Since Mitel MiVoice Connect handles critical enterprise VoIP and business communications, compromise of these appliances can lead to eavesdropping, communication disruption, and unauthorized network access. This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a high EPSS score, indicating a severe and immediate threat to enterprise infrastructure.

Official Vendor Advisories & References

NVD Original English Description

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002

Source: cve@mitre.org · Vendor Advisory

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2022-29499)

FAQ

Q1. How critical is CVE-2022-29499 and is it actively exploited in the wild?

CVE-2022-29499 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 55.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2022-29499?

Primary impacted vendors include mitel across mivoice connect, service appliance. Scope summary: Mitel MiVoice Connect versions up to and including 19.2 SP3 on Service Appliances SA 100, SA 400, and Virtual SA.

Q3. What temporary mitigations or workarounds exist for CVE-2022-29499 before patching?

[Mitigation] Apply the official security patches immediately and restrict access to the management interfaces from the public internet. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION