{"id":"CVE-2022-41223","kind":"vulnerability","aliases":["CVE-2022-41223"],"related":[],"title":"mitel mivoice connect: The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker…","description":"The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.","summary":"Mitel MiVoice Connect's Director component has a code injection flaw that lets an authenticated attacker on the internal network run code inside the application. CISA lists it as exploited in the wild, with tags pointing to ransomware use.","severity":"high","cvss":6.8,"epss":null,"exploited":true,"exploited_at":"2023-02-21T00:00:00+00:00","products":[{"name":"Mitel MiVoice Connect","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"mitel mivoice connect","fixed":[],"affected":"<= 22.22.6100.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","mitel","mivoice-connect","ransomware","self-hosted","vendor","voip"],"not_affected_if":["no-internal-attacker-path","not-running-mivoice-connect"],"how_to_check":null,"fix":"Apply the Mitel update for MiVoice Connect per vendor instructions (CISA KEV required action); the exact fixed version is unknown from the sources.","status":"open","published_at":"2022-11-22T01:15:32+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:38+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:08:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Mitel update for MiVoice Connect per vendor instructions (CISA KEV required action); the exact fixed version is unknown from the sources.","reach":"network","impact":"high","summary":"Mitel MiVoice Connect's Director component has a code injection flaw that lets an authenticated attacker on the internal network run code inside the application. CISA lists it as exploited in the wild, with tags pointing to ransomware use.","category":"vendor","who_cares":["mitel","mivoice-connect","self-hosted","voip"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code in the application context on the internal network.","analyst_note":"Find the fixed version and Mitel advisory for CVE-2022-41223 and a way to detect exploitation on MiVoice Connect Director; the sources only give the KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-internal-attacker-path","not-running-mivoice-connect"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000473,"input_tokens":2795,"output_tokens":387,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':20A,23A '-41223':21A,24A '19.3':12A,89C '22.22.6100.0':13A,90C 'allow':15A,92C 'applic':66B 'attack':18A,57B,95C,102C 'authent':17A,56B,94C 'cisa':67B 'code':50B,63B,100C 'code-inject':99C 'compon':7A,47B,84C 'conduct':97C 'connect':3A,10A,27A,30A,35B,44B,87C 'could':14A,91C 'craft':104C 'cve':19A,22A 'data':105C,113C 'databas':6A,83C,112C 'director':5A,46B,82C 'due':106C 'exploit':31B,71B 'flaw':52B 'host':39B 'inject':51B,101C 'insid':64B 'insuffici':108C 'intern':60B 'let':54B 'list':68B 'mitel':1A,25A,28A,32B,42B 'mivoic':2A,9A,34B,43B,86C 'mivoice':26A,29A 'mivoice-connect':33B 'network':61B 'point':77B 'ransomwar':36B,79B 'restrict':109C 'run':62B 'self':38B 'self-host':37B 'tag':76B 'type':114C 'use':80B 'vendor':40B 'via':103C 'voip':41B 'wild':74B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-11-22T01:15:32+00:00","kev":{"dateAdded":"2023-02-21","dueDate":"2023-03-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-41223","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-41223","severity":null,"published_at":"2023-02-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-41223","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41223","severity":null,"published_at":"2022-11-22T01:15:32+00:00","modified_at":"2026-06-17T05:02:49+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}