CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Mitel MiVoice Connect Director Database Code Injection and Remote Code Execution Vulnerability (CVE-2022-41223) Analysis & Mitigation Guide
[Affected Scope] Mitel MiVoice Connect 19.3 (version 22.22.6100.0 and prior)
[Impact] Authenticated attackers can execute arbitrary code via crafted database inputs, potentially leading to full system compromise
[Mitigation] Apply the official security patches provided in Mitel Advisory 22-0008 immediately and restrict database access
Mitel MiVoice Connect Edge Gateway Remote Command Injection Vulnerability (CVE-2022-40765) Security Advisory
[Affected Scope] Edge Gateway component of Mitel MiVoice Connect through 19.3 (version 22.22.6100.0 and prior)
[Impact] An authenticated attacker with internal network access can execute arbitrary OS commands with system privileges due to insufficient validation of URL parameters
[Mitigation] Apply the official security patches provided by Mitel immediately, or restrict network access to the Edge Gateway management interface
Mitel MiVoice Connect Service Appliance Remote Code Execution Vulnerability Advisory (CVE-2022-29499)
[Affected Scope] Mitel MiVoice Connect through 19.2 SP3 Service Appliances (SA 100, SA 400, and Virtual SA).
[Impact] Unauthenticated remote attackers can exploit incorrect data validation to execute arbitrary code and gain full control over the affected appliance.
[Mitigation] Apply the official security patches immediately and restrict access to the management interfaces from the public internet.