{"id":"CVE-2022-29499","kind":"vulnerability","aliases":["CVE-2022-29499"],"related":[],"title":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of…","description":"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.","summary":"Unauthenticated RCE in the Service Appliance component of Mitel MiVoice Connect (SA 100, SA 400, Virtual SA), CVSS 9.8. Exploited as a zero-day in a suspected ransomware intrusion (CrowdStrike) and in CISA KEV since 2022-06-27. Only deployments with a Service Appliance are affected. Attackers chain a request to /scripts/vtest.php (get_url) to reach ucbsync.php from localhost, then inject a command through the syncfile parameter.","severity":"critical","cvss":10.0,"epss":0.55242,"exploited":true,"exploited_at":"2022-06-27T00:00:00+00:00","products":[{"name":"Mitel MiVoice Connect","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Mitel MiVoice Connect (Service Appliance SA 100/SA 400/Virtual SA)","fixed":[],"affected":"<= 19.2 SP3 (22.20.2300.0), including 14.x","ecosystem":"vendor"},{"name":"mitel mivoice connect","fixed":[],"affected":"<= 22.20.2300.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kev","mitel-mivoice-connect","ransomware","rce","self-hosted","voip"],"not_affected_if":["no-service-appliance","not-internet-exposed","unknown"],"how_to_check":"Check whether you run MiVoice Connect 19.2 SP3 (22.20.2300.0) or earlier, including 14.x, with an SA 100, SA 400 or Virtual SA. Confirm the appliance's web interface is not reachable from the internet. Hunt in HTTP access logs for GET /scripts/vtest.php?get_url=... and /ucbsync.php?cmd=syncfile requests. Look for /vhelp/pdf/pdf_import.php, a binary named memdump (Chisel), /tmp/.svc_bkp_1, and outbound requests to unknown hosts for /shoretel/wc2_deploy.","fix":"Apply the remediation in Mitel Security Bulletin 22-0002-001 (linked from the advisory, via Mitel Product Support). CERT-FR reports a permanent fix in MiVoice Connect R19.3, planned for June 2022; I did not confirm that build number on a Mitel page. Do not expose the Service Appliance to the internet, and treat any exposed unpatched appliance as compromised.","status":"open","published_at":"2022-04-26T02:15:37+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:26+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:12:26Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates per Mitel instructions; CISA's required action is to apply updates per vendor instructions. Fixed version: unknown","reach":"unknown","impact":"high","summary":"Mitel MiVoice Connect's Service Appliance has a data validation flaw that allows remote code execution. An attacker who can reach the service can run code on the appliance without a valid login.","category":"infrastructure","who_cares":["mitel-mivoice-connect","voip","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote code execution on the Service Appliance, possibly full appliance takeover.","analyst_note":"Find the Mitel advisory for CVE-2022-29499 to get affected and fixed versions, the vulnerable Service Appliance component, and exposure details; ransomware tag and KEV listing indicate active exploitation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000473,"input_tokens":2830,"output_tokens":379,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Mitel advisory for CVE-2022-29499 to get affected and fixed versions, the vulnerable Service Appliance component, and exposure details; ransomware tag and KEV listing indicate active exploitation.","search":"'-06':87B '-2022':17A,20A '-27':88B '-29499':18A,21A '/scripts/vtest.php':102B '100':62B,143C '100/sa':31A '19.2':10A,127C '2022':86B '400':64B,145C '400/virtual':32A '9.8':68B 'affect':96B 'allow':12A,129C 'applianc':3A,55B,94B,120C,140C 'appliance':29A 'attack':97B 'chain':98B 'cisa':83B 'code':14A,131C 'command':113B 'compon':4A,56B,121C 'connect':8A,24A,27A,36A,43B,60B,125C 'crowdstrik':80B 'cve':16A,19A 'cvss':67B 'data':136C 'day':74B 'deploy':90B 'execut':15A,132C 'exploit':37B,69B 'get':103B 'host':48B 'incorrect':135C 'infrastructur':38B 'inject':111B 'intrus':79B 'kev':39B,84B 'localhost':109B 'mitel':6A,22A,25A,34A,41B,58B,123C 'mitel-mivoice-connect':40B 'mivoic':7A,42B,59B,124C 'mivoice':23A,26A,35A 'paramet':117B 'ransomwar':44B,78B 'rce':45B,51B 'reach':106B 'remot':13A,130C 'request':100B 'sa':30A,33A,61B,63B,66B,142C,144C,148C 'self':47B 'self-host':46B 'servic':2A,54B,93B,119C,139C 'service':28A 'sinc':85B 'sp3':11A,128C 'suspect':77B 'syncfil':116B 'ucbsync.php':107B 'unauthent':50B 'url':104B 'valid':137C 'virtual':65B,147C 'voip':49B 'zero':73B 'zero-day':72B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-04-26T02:15:37+00:00","kev":{"dateAdded":"2022-06-27","dueDate":"2022-07-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-29499","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-29499","severity":null,"published_at":"2022-06-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2022-29499","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29499","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-29499:47","url":null,"severity":null,"published_at":"2026-10-23T21:16:56+00:00","modified_at":"2026-10-23T21:16:56+00:00","first_seen_at":"2026-10-23T21:16:56+00:00","fetched_at":"2026-10-23T21:16:56+00:00","note":"Read Mitel advisory 22-0002 (rev 4.0), CrowdStrike write-up (zero-day, ransomware intrusion, exploit details, no public PoC script but request pattern published), CERT-FR. Exact fixed build not on the public advisory page (it points to bulletin 22-0002-001); CERT-FR says fix in R19.3 (planned June 2022), unconfirmed."},{"source":"nvd","external_id":"CVE-2022-29499","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29499","severity":null,"published_at":"2022-04-26T02:15:37+00:00","modified_at":"2026-08-06T05:16:37+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":926,"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002","title":"Mitel Security Advisory 22-0002","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":928,"url":"https://www.crowdstrike.com/en-us/blog/novel-exploit-detected-in-mitel-voip-appliance/","title":"CrowdStrike: Novel Exploit in Mitel VOIP Appliance","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":930,"url":"https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-359","title":"CERT-FR CERTFR-2022-AVI-359","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}