{"id":"CVE-2022-29499","aliases":["EUVD-2022-33836","GHSA-f4rg-w9qm-5f42"],"status":"published","title":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code...","description":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.55242,"percentile":0.99036,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2022-04-26T01:13:58Z","modified":"2026-08-06T05:16:37Z","kev":{"date_added":"2022-06-27","due_date":"2022-07-18","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-06-27"},{"source":"kev","since":"2022-06-27"}],"products":[{"vendor":"mitel","product":"mivoice connect"},{"vendor":"mitel","product":"mivoice_connect"}],"references":[{"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29499"},{"url":"https://github.com/advisories/GHSA-f4rg-w9qm-5f42"}],"sources":{"cve":[{"id":"CVE-2022-29499","description":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.","status":"published","published":"2022-04-26T01:13:58Z","modified":"2026-08-06T03:55:35.248Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-33836","description":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.","status":"published","published":"2022-04-26T01:13:58Z","modified":"2026-08-06T03:55:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-06-27","updated_at":"2026-11-02T18:02:09.043832Z"}],"ghsa":[{"id":"GHSA-f4rg-w9qm-5f42","title":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code...","description":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.","status":"published","published":"2022-04-27T00:00:21Z","modified":"2025-10-22T00:33:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2022-29499","title":"Mitel MiVoice Connect Data Validation Vulnerability","description":"The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.","cwes":["CWE-20"],"kev":{"date_added":"2022-06-27","due_date":"2022-07-18","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-29499","description":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.","status":"published","published":"2022-04-26T02:15:37.107Z","modified":"2026-08-06T05:16:37.23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:18.660414Z"}]}}