CVE-2022-41223

What is Mitel MiVoice Connect?

Mitel MiVoice Connect is an enterprise unified communications platform. The Director component is the central management server for the MiVoice Connect system, controlling configuration, users, and system-wide settings. See also CVE-2022-40765 for the related command injection vulnerability in the Edge Gateway component. Both CVEs were added to KEV on the same day following ransomware exploitation.

Overview

CVE-2022-41223 is a code injection vulnerability (CWE-94) in the Director component of Mitel MiVoice Connect. An authenticated attacker with internal network access can inject and execute code within the application context of the Director. Combined with CVE-2022-40765, this provides threat actors with multiple execution vectors across the MiVoice Connect platform.

Affected Versions

Technical Details

The Director component does not properly validate or sanitize user-supplied input before incorporating it into code execution paths (CWE-94). An authenticated admin-level attacker on the internal network can inject malicious code that executes within the Director's application context.

• Attack vector: Adjacent — internal network access required
• Authentication required: High — admin-level MiVoice credentials
• Impact: Code execution within the Director application context
• Combined exploitation: Used alongside CVE-2022-40765 (Edge Gateway command injection) to achieve broader compromise of the MiVoice Connect infrastructure

Discovery

Reported to Mitel via coordinated disclosure.

Exploitation Context

Confirmed ransomware exploitation; added to KEV February 2023. Threat actors used MiVoice Connect vulnerabilities to establish a foothold in enterprise telephony infrastructure before pivoting to broader network compromise and ransomware deployment.

Remediation

1. Upgrade MiVoice Connect to version 19.3 SP3 or later
2. Restrict Director management interface access to trusted administrator IPs only
3. Rotate all administrative credentials for MiVoice Connect
4. Review Director logs for unauthorized access or unexpected code execution