CVE-2022-41223
Mitel MiVoice Connect Code Injection Vulnerability
Published Nov 21, 2022 · updated Jun 16, 2026 · mitel mivoice connect
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
Timeline
Detection, updates, and resolution for this record.
Nov 21, 2022 · Catalog
Detected
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
Feb 21, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 14, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
Required action
Apply updates per vendor instructions.
CISA due date Mar 14, 2023
Affected
- cpe mitel/mivoice connectversion unspecified
- vendor Mitel MiVoice Connectversion unspecified
Sources
- CISA KEVCVE-2022-41223
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
cisa.gov - CVE.orgCVE-2022-41223
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-41223
30-day exploitation probability 10.7%
first.org - NIST NVDCVE-2022-41223
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
nvd.nist.gov