{"id":"CVE-2022-41223","published":"2022-11-22T01:15:32Z","modified":"2026-06-17T05:02:49Z","title":"Mitel MiVoice Connect Code Injection Vulnerability","vendor":"Mitel","product":"MiVoice Connect","tier":"core","eol":null,"description":{"text":"The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.","provenance":"source","from":"NVD"},"summary":{"text":"The Director database component of Mitel MiVoice Connect (through version 19.3, build 22.22.6100.0) contains a code-injection flaw caused by insufficient restrictions on its database data type. An attacker who holds valid authentication, with the attack reaching the component over the network, can inject code through crafted data and execute it, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:02Z"},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.10657,"percentile":0.95787,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-02-21","dueDate":"2023-03-14","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008;  https://nvd.nist.gov/vuln/detail/CVE-2022-41223","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-02-21","exploitedFirstSeen":"2023-02-21","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-02-21"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://www.mitel.com/support/security-advisories","tags":["Vendor Advisory"]},{"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008","tags":["Vendor Advisory"]},{"url":"https://www.mitel.com/support/security-advisories","tags":["Vendor Advisory"]},{"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41223","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploits exposed Mitel MiVoice Connect service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Director database component of MiVoice Connect","start":4,"end":50}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Code injection yields command or code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allow an authenticated attacker to conduct a code-injection attack","start":85,"end":151}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-44464","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44464","exploited":true,"exploitedSince":"2023-02-21","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2022-11-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41223","provenance":"source"},{"date":"2023-02-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2023-02-21","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-02-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44464","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":91},"priority":{"score":71.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1346 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.16,"detail":"percentile 0.9579"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.76,"detail":"base score 6.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}