CVE-2022-41223
Mitel MiVoice Connect Code Injection Vulnerability
Description
CVE-2022-41223 is a code injection vulnerability in the Director database component of Mitel MiVoice Connect through version 19.3 (22.22.6100.0). The flaw allows an authenticated attacker with adjacent network access to execute arbitrary code by exploiting insufficient restrictions on database data types. While the vulnerability requires high privileges and adjacent network access, its exploitation can lead to complete system compromise. CISA has confirmed active exploitation of CVE-2022-41223 in the wild and identified its use in ransomware campaigns, underscoring the importance of prompt remediation for organizations using Mitel MiVoice Connect.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mitel | mivoice connect | <= 22.22.6100.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.mitel.com/support/security-advisories(Vendor Advisory)
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41223(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
In Mitel MiVoice Connect, CWE-94 manifests through the Director database component, which fails to properly restrict the types of data that can be inserted into database fields. An authenticated attacker can craft malicious data entries that are interpreted and executed as code by the application, bypassing the intended data processing boundaries and achieving arbitrary code execution on the underlying system.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2022-41223 carries a CVSS score of 6.8 (Medium) but should not be underestimated given its confirmed use in ransomware operations. The vulnerability requires adjacent network access (Attack Vector: Adjacent), meaning the attacker must be on the same network segment as the target system — this is not exploitable directly from the internet. Attack complexity is low, requiring no special conditions once network proximity is established. High privileges are required to exploit the flaw, limiting the attack surface to authenticated administrative users. No user interaction is needed for exploitation. Confidentiality, integrity, and availability are all rated as High impact, meaning a successful attack can result in complete system compromise including data exfiltration, system modification, and service disruption. Despite the Medium severity rating, the confirmed ransomware association and CISA KEV listing elevate the real-world risk significantly beyond what the CVSS score alone suggests.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-41223 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 14, 2023. Notably, this vulnerability is associated with known ransomware campaigns, indicating that threat actors are leveraging it as part of broader attack chains against organizations using Mitel MiVoice Connect. While no public proof-of-concept exploit code was identified in the available references, the confirmed active exploitation and ransomware association indicate a mature threat. The EPSS score of 2.6% (85th percentile) suggests moderate exploitation probability, though the KEV listing confirms real-world attacks are already occurring.
Remediation
- Apply Mitel security patches immediately. Follow the guidance in Mitel Product Security Advisory 22-0008 to update MiVoice Connect to a patched version that addresses the code injection vulnerability in the Director database component. CISA requires remediation by 2023-03-14.
- Upgrade MiVoice Connect beyond version 19.3. Ensure that your MiVoice Connect installation is updated past version 19.3 (build 22.22.6100.0), as all versions through this release are confirmed vulnerable.
- Restrict network access to the Director component. Implement network segmentation to limit adjacent network access to the Director database component. Only authorized management stations should have connectivity to the MiVoice Connect administration interfaces.
- Audit administrative accounts and access privileges. Since exploitation requires high privileges, review all administrative accounts on the MiVoice Connect platform. Remove unnecessary admin accounts, enforce strong authentication, and enable audit logging for all administrative actions.
- Monitor for indicators of compromise. Review system logs for unusual database operations, unexpected code execution, or signs of lateral movement. Check for unauthorized scheduled tasks, new user accounts, or ransomware-related file encryption patterns that may indicate prior exploitation.
Technical Details
CVE-2022-41223 is classified under CWE-94 (Improper Control of Generation of Code) and affects the Director database component of Mitel MiVoice Connect through version 19.3 (22.22.6100.0). The vulnerability arises from insufficient restrictions on the data types accepted by the database component, which allows an authenticated attacker to inject crafted data that is subsequently interpreted and executed as code. The CVSS vector (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that while the attack requires adjacent network proximity and high-privilege authentication, the exploitation itself is straightforward with low complexity. The scope remains unchanged, meaning the impact is confined to the vulnerable component and its host system, but all three impact dimensions — confidentiality, integrity, and availability — are fully compromised upon successful exploitation. The code injection occurs at the database layer, suggesting that the application fails to sanitize or type-check input before processing it in a context where it can influence code execution paths.
Frequently Asked Questions
Is CVE-2022-41223 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2022-41223 in the wild and added it to the Known Exploited Vulnerabilities catalog. This vulnerability is also associated with known ransomware campaigns, making it a critical priority for organizations running Mitel MiVoice Connect. The EPSS score of 2.6% reflects moderate baseline exploitation probability, but real-world attacks are confirmed.
What products are affected by CVE-2022-41223?
CVE-2022-41223 affects Mitel MiVoice Connect through version 19.3 (build 22.22.6100.0). Specifically, the vulnerability is in the Director database component of the platform. All versions up to and including 19.3 are vulnerable and require patching.
How do I fix CVE-2022-41223?
Apply the security patch described in Mitel Product Security Advisory 22-0008 and upgrade MiVoice Connect beyond version 19.3. Additionally, restrict adjacent network access to the Director database component and audit all administrative accounts. See the Remediation section for a complete step-by-step guide.
How severe is CVE-2022-41223?
CVE-2022-41223 is rated Medium with a CVSS score of 6.8, as it requires adjacent network access and high privileges. However, the real-world severity is elevated by its confirmed use in ransomware campaigns and active exploitation status in the CISA KEV catalog. A successful exploit results in full compromise of system confidentiality, integrity, and availability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.