PT-2022-25738 · Mitel · Mivoice Connect

Patrick Bennett · Published 2022-11-22 · Updated 2023-02-22 · CVE-2022-41223

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MiVoice Connect versions through 19.3 (22.22.6100.0)

Description The issue allows an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type in the Director database component.

Recommendations For MiVoice Connect versions through 19.3 (22.22.6100.0), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-41223

Affected Products

Mivoice Connect

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-41223 · Security Note
• https://mitel.com/support/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41223 · Vendor Advisory
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008 · Vendor Advisory, Security Note
• https://t.me/echeloneyes/1221 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41223 · Note
• https://t.me/thehackernews/3079 · Telegram Post
• https://t.me/cibsecurity/53303 · Telegram Post