CVE-2022-29499: Mitel MiVoice Connect Service Appliance Remote Code Execution (KEV, Actively Exploited)

CVE-2022-29499 is a critical remote-code-execution vulnerability (CWE-20, improper input validation) in the Service Appliance component of Mitel's MiVoice Connect unified-communications platform — the on-premises SA 100 and SA 400 hardware appliances, and the Virtual SA — that lets a remote, unauthenticated attacker send a specially crafted HTTP GET request to execute arbitrary operating-system commands on the device; NVD has published its own Primary CVSS v3.1 score of 9.8 (critical), and CISA added the flaw to its Known Exploited Vulnerabilities catalog after it was used as a ransomware group's initial-access vector.

CVE-2022-29499 (CWE-20, improper input validation) affects the Service Appliance component of Mitel's MiVoice Connect voice/UC platform. NVD's description states: "The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA" (NVD).

Mitel's own Product Security Advisory 22-0002 confirms the issue, describing "a vulnerability ... which could allow a malicious actor to perform remote code execution (CVE-2022-29499) within the context of the Service Appliance," affecting MiVoice Connect (including version 14.2 and earlier) through 19.2 SP3 and deployments that include the SA 100, SA 400 or Virtual SA Service Appliances; the advisory recommends customers apply the available remediation and consult Security Bulletin 22-0002-001 or Product Support for details, without publishing a single fixed-version number in the advisory text itself (Mitel Product Security Advisory 22-0002).

NVD lists its own Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching the Secondary score submitted by CISA's coordination team (NVD).

CISA added CVE-2022-29499 to its Known Exploited Vulnerabilities catalog on 2022-06-27, titled "Mitel MiVoice Connect Data Validation Vulnerability," with a required action to "Apply updates per vendor instructions" and a due date of 2022-07-18 (CISA KEV).

The vulnerability was discovered during a ransomware intrusion investigation: CrowdStrike Services traced malicious activity on a compromised network to a Mitel MiVoice Connect VOIP appliance on the perimeter, and after imaging the device, recovered forensic evidence of "a novel remote code execution exploit used by the threat actor to gain initial access to the environment." CrowdStrike describes the exploit as two coordinated HTTP GET requests — the first bypassing an IP restriction via a get_url parameter, the second injecting a parameter into a syncfile command that the appliance later used inside a curl call — letting the attacker pipe a response into a shell and open a reverse connection back to attacker infrastructure with openssl s_client (CrowdStrike: Novel Exploit Detected in Mitel VOIP Appliance). The intrusion CrowdStrike investigated was later linked to the Lorenz ransomware operation's use of this same flaw to gain a foothold before deploying the Chisel tunneling tool.

FIRST scores the probability of exploitation for CVE-2022-29499 at 0.55242 (99.036th percentile) as of 2026-11-07, reflecting its continued status as a widely and repeatedly exploited flaw years after disclosure (FIRST EPSS).

Any organization still running a MiVoice Connect Service Appliance (SA 100, SA 400 or Virtual SA) should treat this as an urgent patch-or-isolate priority: confirm the deployment is past build 22.20.2300.0, follow Mitel's Security Bulletin 22-0002-001, and ensure the appliance is not directly reachable from the internet.

• The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 (Service Appliances SA 100, SA 400, Virtual SA) allows remote code execution because of incorrect data validation (CWE-20). — NVD
• Mitel's advisory confirms the vulnerability affects MiVoice Connect (including version 14.2 and earlier) through 19.2 SP3 and SA 100/SA 400/Virtual SA deployments, recommends applying available remediation, and refers customers to Security Bulletin 22-0002-001 / Product Support rather than publishing one fixed-version number. — Mitel Product Security Advisory 22-0002
• NVD Primary CVSS v3.1 base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching CISA's Secondary submission. — NVD
• Added to the CISA KEV catalog on 2022-06-27 as "Mitel MiVoice Connect Data Validation Vulnerability"; required action "Apply updates per vendor instructions"; due date 2022-07-18. — CISA KEV
• Discovered during a ransomware IR engagement after forensic recovery of the novel RCE exploit used for initial access; exploit chain uses two chained HTTP GET requests (get_url bypass, then a syncfile-command parameter injected into a curl call) to open a reverse shell via openssl s_client. — CrowdStrike
• FIRST EPSS probability of exploitation is 0.55242 (99.036th percentile) as of 2026-11-07. — FIRST EPSS