---
id: "CVE-2022-29499"
kind: "vulnerability"
aliases: ["CVE-2022-29499"]
title: "The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of\u2026"
severity: "critical"
cvss: 10.0
epss: 0.55242
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Mitel MiVoice Connect", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Mitel MiVoice Connect (Service Appliance SA 100/SA 400/Virtual SA)", "fixed": [], "affected": "<= 19.2 SP3 (22.20.2300.0), including 14.x", "ecosystem": "vendor"}, {"name": "mitel mivoice connect", "fixed": [], "affected": "<= 22.20.2300.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "kev", "mitel-mivoice-connect", "ransomware", "rce", "self-hosted", "voip"]
not_affected_if: ["no-service-appliance", "not-internet-exposed", "unknown"]
published_at: "2022-04-26T02:15:37+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-29499", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29499", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:16:56+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29499", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of…

Unauthenticated RCE in the Service Appliance component of Mitel MiVoice Connect (SA 100, SA 400, Virtual SA), CVSS 9.8. Exploited as a zero-day in a suspected ransomware intrusion (CrowdStrike) and in CISA KEV since 2022-06-27. Only deployments with a Service Appliance are affected. Attackers chain a request to /scripts/vtest.php (get_url) to reach ucbsync.php from localhost, then inject a command through the syncfile parameter.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Mitel MiVoice Connect affected ? fixed ?
- vendor:Mitel MiVoice Connect (Service Appliance SA 100/SA 400/Virtual SA) affected <= 19.2 SP3 (22.20.2300.0), including 14.x fixed ?
- vendor:mitel mivoice connect affected <= 22.20.2300.0 fixed ?

## How to check

Check whether you run MiVoice Connect 19.2 SP3 (22.20.2300.0) or earlier, including 14.x, with an SA 100, SA 400 or Virtual SA. Confirm the appliance's web interface is not reachable from the internet. Hunt in HTTP access logs for GET /scripts/vtest.php?get_url=... and /ucbsync.php?cmd=syncfile requests. Look for /vhelp/pdf/pdf_import.php, a binary named memdump (Chisel), /tmp/.svc_bkp_1, and outbound requests to unknown hosts for /shoretel/wc2_deploy.

## Fix

Apply the remediation in Mitel Security Bulletin 22-0002-001 (linked from the advisory, via Mitel Product Support). CERT-FR reports a permanent fix in MiVoice Connect R19.3, planned for June 2022; I did not confirm that build number on a Mitel page. Do not expose the Service Appliance to the internet, and treat any exposed unpatched appliance as compromised.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-29499
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-29499
- 2026-10-23T21:16:56+00:00 analyst — Read Mitel advisory 22-0002 (rev 4.0), CrowdStrike write-up (zero-day, ransomware intrusion, exploit details, no public PoC script but request pattern published), CERT-FR. Exact fixed build not on the public advisory page (it points to bulletin 22-0002-001); CERT-FR says fix in R19.3 (planned June 2022), unconfirmed.
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-29499

## Documents

- [advisory] Mitel Security Advisory 22-0002 https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002
- [describes] CrowdStrike: Novel Exploit in Mitel VOIP Appliance https://www.crowdstrike.com/en-us/blog/novel-exploit-detected-in-mitel-voip-appliance/
- [fix] CERT-FR CERTFR-2022-AVI-359 https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-359

## From the sources

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_