CVE-2022-29499

This flaw lets an attacker send specially crafted network messages to your Mitel phone system hardware/software and run commands on it. The result is similar to someone finding a door that locks are supposed to stop, but the “lock” is actually broken—so they can get full control of the appliance. Once they control it, they can disrupt your phone services and potentially enable ransomware.

This matters if your business uses Mitel MiVoice Connect version 19.2 SP3 or earlier running on a Service Appliance (SA 100, SA 400, or Virtual SA). Because the issue does not require a login or user interaction, it becomes relevant when the appliance is reachable over the network in your environment—especially if it’s exposed to the internet.

This is RED because it’s been confirmed in CISA’s Known Exploited Vulnerabilities list and has been used in ransomware campaigns. The attacker does not need credentials or user interaction—only network reachability—so systems can be compromised quickly once reachable.

1. Confirm exposure

   • Identify the Mitel MiVoice Connect version on each Service Appliance (SA 100, SA 400, or Virtual SA).
   • Determine whether each affected device is Mitel MiVoice Connect 19.2 SP3 or earlier.

2. Check patch status

   • Compare your installed software against Mitel’s fixed update(s described in Mitel Product Security Advisory 22-0002.
   • If the advisory provides multiple branches, pick the update that matches your current branch and supported upgrade path.

3. Upgrade / patch

   • Download and install the vendor updates strictly from trusted sources (as directed by Mitel’s advisory).
   • Follow Mitel’s step-by-step upgrade procedure for Service Appliances, including any required restart/reboot windows and configuration migration steps.
   • After upgrading, validate that the Service Appliance component is updated as required by the advisory.

4. If patching must be delayed

   • Reduce network exposure immediately: restrict access so the Service Appliance is not reachable from the public internet.
   • Allow only required internal management/communication paths (per your network design).
   • Monitor for unusual inbound traffic targeting the Service Appliance from unexpected sources.

5. Reporting and monitoring

   • Confirm with your IT/vendor that the update(s from 22-0002 are applied on all SA 100/SA 400/Virtual SA instances.
   • Review logs for signs of remote compromise around the timeframe of any suspicious network events.

6. Timing

   • CISA KEV remediation due date was 2022-07-18; treat any unpatched deployment as overdue.

Severity and risk: This is a remote code execution issue with very high impact (full compromise of the Service Appliance), and it is confirmed as exploited in the real world via CISA KEV.

Mechanism: The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 contains incorrect data validation. Attackers can send crafted network input that the component mishandles, resulting in arbitrary code execution.

Attack vector and requirements: Network-based access with no authentication required and no user interaction needed. The findings state it is reachable in default configuration.

Exploitation status: Listed in CISA KEV, added 2022-06-27, with a CISA remediation due date of 2022-07-18, and described as used in ransomware campaigns.

Exploit maturity: Real-world weaponization is strongly indicated by the KEV listing; EPSS was provided as a prediction (not used here to drive the urgency since KEV is confirmed).