CVE-2022-29499 — VulnIntel

CVE-2022-29499

CRITICAL

KEV

Ransomware

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

Status

설명

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

Score Summary

CVSS Score: 9.8
Version: 3.1
VPI: 100
Why this VPI (explainable, experimental)
VPI breakdown
Impact 98.00
Exploitation signal(KEV listed) ×1.50
Ransomware bonus +5.00
VPI 100.00
VPI formula vpi-v1
EPSS: 56.6%
(상위 99.0%)
Attack Vector: Network
Low Complexity
No Privileges
No User Interaction
Scope Unchanged
High Confidentiality Impact
High Integrity Impact
High Availability Impact

Details

Published: 04/26/2022(4 years ago)
Modified: 11/03/2025(9 months ago)
Source: KEV, NVD
Products: 1

CISA KEV Listing

Ransomware

Vendor / Project: Mitel
Product: MiVoice Connect

Date Added: 06/27/2022
Due Date: 07/18/2022Overdue 1466d

Required Action

Apply updates per vendor instructions.

Vulnerability Lifecycle

NVDPublished04/26/2022
CISA KEVKEV Listed06/27/2022
CISA KEV

Score Comparison by Source

Source	CVSS Version	Base Score	Severity	Vector String	Assessment Date
NVDNIST	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	04/20/2026
NVDNIST	2.0	10.0

CWE Weakness Classification

CWE-20
NVD
Secondary

References (2)

Affected Products (1)

Impact	98.00
Exploitation signal(KEV listed)	×1.50
Ransomware bonus	+5.00
VPI	100.00