Critical · published April 26, 2022
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.
🚨 A single data validation error in Mitel MiVoice Connect could let attackers execute malicious code remotely, and it’s happening now! 🔥 Think of it like a restaurant that lets patrons walk into the kitchen without checking their orders — one wrong move and they could toss raw ingredients into the chef's special, ruining the whole meal! An attacker could gain total control over the affected appliances, leading to unauthorized access and manipulation of sensitive information. This could result in a complete service disruption or even data breaches that compromise your organization’s integrity and security!
Think of it like a restaurant that lets patrons walk into the kitchen without checking their orders — one wrong move and they could toss raw ingredients into the chef's special, ruining the whole meal! This vulnerability arises from the Service Appliance component's failure to validate incoming data properly, allowing malicious commands to be executed without proper authorization.
An attacker could gain total control over the affected appliances, leading to unauthorized access and manipulation of sensitive information. This could result in a complete service disruption or even data breaches that compromise your organization’s integrity and security! Immediately update your Mitel MiVoice Connect to the latest patch (19.2 SP4 or later) to address this flaw. Additionally, conduct a security audit of your configurations and monitor for any unusual activity on your appliances. You've got this! By taking swift action, you'll safeguard your systems and protect your network. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mitel/mivoice_connect | ≤ 22.20.2300.0 | — |