CVE-2022-41223: Mitel MiVoice Connect Code Injection Vulnerability

KEVRansomware

Analyzed

Published 22-11-2022Last modified 21-10-2025

Vulnerability summary

CVE-2022-41223 is a medium (CVSS 6.8) Improper Control of Generation of Code vulnerability in Mitel MiVoice Connect. It is known to be exploited: CISA lists it, first on 21-02-2023. It has been used in ransomware campaigns. EPSS estimates a 10.66% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.

Priority

Act nowransomware

Known ransomware use (CISA, 21-02-2023)

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v3.1 (CVE.org)

EPSS score

10.66%

0%100%

Medium · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareKnown useFlagged by CISA

Public exploits0No public exploits recorded

Timeline

22-11-2022
PublishedVulnerability first disclosed.
21-02-2023
Added to CISA KEVExploitedMitel MiVoice Connect Code Injection Vulnerability
14-03-2023
CISA remediation dueDeadline passedApply updates per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

CVSS metrics

2 scores · 2 sources · 1 version

v3.16.8

EPSS trend

Probability

10.66%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.66% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 21-02-2023
Federal due date: 14-03-2023

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008 nvd.nist.gov/vuln/detail/CVE-2022-41223

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: adjacent network, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Mitel1 product

mivoice_connect≤ 22.22.6100.0

1 vendor · 1 product

References

3 links

www.mitel.com/support/security-advisoriesVendor Advisory
www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41223Government ResourceUS Government Resource