Mitel MiVoice Connect Data Validation Vulnerability (CVE-2022-29499)

What is affected, what to do

An attacker can achieve remote code execution (RCE) due to incorrect data validation in the Service Appliance component of Mitel MiVoice Connect, affecting versions up to 19.2 SP3, including models SA 100, SA 400, and Virtual SA. This vulnerability is actively exploited in ransomware campaigns, necessitating immediate action. Organizations should urgently update to version 22.20.2300.0 to mitigate the risk.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Mitel MiVoice Connect lte *..22.20.2300.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every Mitel MiVoice Connect Service Appliance (SA 100, SA 400, Virtual SA) and record its software version. Per NVD, releases through 19.2 SP3 are affected.
   • Apply the fix or remediation script: A patch is available from the vendor — look up the exact version in the Mitel advisory. Mitel also published a remediation script for affected releases; confirm in the advisory that it applies to your release.
   • Remove internet exposure now: Block inbound internet access to the appliance web interface (typically 80/443) at the perimeter firewall. Restrict access to VPN or an allowlist of internal admin subnets.
   • Hunt for compromise before trusting the box again: Public reporting describes these appliances being used as the initial foothold for ransomware intrusions, followed by lateral movement into the Windows estate. Preserve appliance logs and check for reverse shells, unexpected files in web directories and new cron entries.
   • Rotate credentials: If compromise is suspected, rotate all credentials stored on or used by the appliance: local admin accounts, SSH keys, and AD/LDAP bind and service accounts.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place Service Appliances in a dedicated voice/DMZ segment. Enforce default-deny egress so appliances can reach only the required SIP/RTP peers and update servers. This kills most reverse-shell callbacks at the firewall.
   • East-west control: Block traffic from the voice segment to server and client networks unless it is required. This applies especially to SMB (445), RDP (3389), WinRM (5985/5986) and LDAP/Kerberos to domain controllers.
   • WAF/IPS: Alert on or drop HTTP requests to the appliance that contain URL-encoded CR/LF (%0d, %0a) or embedded URLs in query parameters. Public analyses point to /scripts/vtest.php as the attack surface. If you don't need that path, deny it at a reverse proxy.
   • Hardening and access control: Allow admin access only from MFA-protected jump hosts and disable unused services. You can't run EDR on the appliance, so compensate with network monitoring.
   • Lifecycle: Confirm your MiVoice Connect release is still supported. If it isn't, schedule migration per Mitel's roadmap.
3. 03

   Runbook step 3

   Detection rules

   • Appliance or reverse-proxy web logs: Look for hits on vtest.php or CR/LF sequences in the query string, e.g. in SPL: index=proxy dest=<SA-IP> (uri_path="*vtest.php*" OR uri_query="*%0d*" OR uri_query="*%0a*").
   • Zeek/Suricata egress: Flag any new outbound TCP session from appliance IPs to external hosts on unusual ports. Also flag TLS sessions without SNI, which match an openssl s_client reverse shell. Sigma shape: src_ip in voice_appliances AND dst_ip not in allowlist AND direction=outbound.
   • Process artefacts on the appliance (shell history/syslog, where available): Watch for mkfifo, FIFO files in /tmp/, openssl s_client, nc or bash -i spawned by the web-server user. Treat wget/curl downloads by the web-server process the same way.
   • Lateral movement into Windows: Watch for logons sourced from voice/appliance IPs: Event ID 4624 (logon type 3/10) and 4625. Also check Event ID 4769 (Kerberos service-ticket requests) from the voice segment and Sysmon EID 3 on servers with a voice-VLAN source. KQL: SecurityEvent | where EventID in (4624,4625) and IpAddress in (voice_ips).
   • Ransomware precursors: On hosts that recently received connections from the voice segment, correlate exfiltration tooling (e.g. rclone, FileZilla) and new service installs (Event ID 7045).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

Source: cvelistv5, CISA KEV Catalog, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Mitel Mitel MiVoice Connect

References & sources

• mitel.comsupport/security-advisories/mitel-product-security-advisory-22-…x_refsource_CONFIRM
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499government-resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 06.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2022-29499","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2025-01-29T16:10:59.913484Z"}	{"id":"CVE-2022-29499","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2022-06-27T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0