Exploited vulnerability · CISA KEV

Is CVE-2022-41223 exploited? Yes: in CISA KEV since 21 Feb 2023

Gociux · Mitel MiVoice Connect · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2022-41223, Mitel MiVoice Connect Code Injection Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 21 Feb 2023, 91 days after it was published. It is known to be used in ransomware campaigns. It affects Mitel MiVoice Connect. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.

What to do

1. Check whether you run it. Look for MiVoice Connect in your asset inventory, including appliances and cloud images. Stack check lists every exploited Mitel CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 22 Nov 2022.
4. Get told next time. Email alerts when CISA adds a CVE for Mitel.

Other exploited CVEs in MiVoice Connect

• CVE-2022-40765: Mitel MiVoice Connect Command Injection Vulnerability (21 Feb 2023)
• CVE-2022-29499: Mitel MiVoice Connect Data Validation Vulnerability (27 Jun 2022)

References

• www.mitel.com/support/security-advisories/mitel-product-security-advisory
• nvd.nist.gov/vuln/detail/CVE-2022-41223

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in February 2023 · Mitel scorecard · act-now radar.