CVE-2022-29499

What it actually does

CVE-2022-29499 is an unauthenticated remote code execution vulnerability in the Mitel MiVoice Connect Service Appliance component, affecting SA 100, SA 400, and Virtual SA appliances through 19.2 SP3. The flaw stems from incorrect input validation in exposed service functionality, allowing a remote network attacker to submit crafted requests that are interpreted as executable commands or otherwise trigger arbitrary code execution on the appliance. Because exploitation requires no authentication, no user interaction, and has network attack vector characteristics, successful exploitation can provide full compromise of the appliance, including access to sensitive configuration data, credential material, call-routing infrastructure, and a foothold for lateral movement.

Why it matters to the business

A compromised MiVoice Connect Service Appliance can disrupt voice communications, expose sensitive telephony and configuration data, and provide attackers with an entry point into the broader network. This vulnerability is in the CISA Known Exploited Vulnerabilities catalog, has been observed in active exploitation, and is associated with ransomware activity; the CISA remediation deadline of 2022-07-18 has long passed. Organizations operating exposed or unpatched Mitel MiVoice Connect appliances should treat this as an urgent incident-response and remediation priority, not just a routine patching issue.

How an attack unfolds

An attacker first identifies an internet-reachable Mitel MiVoice Connect Service Appliance, often by scanning for characteristic web services, banners, certificates, or appliance-specific paths. The attacker then sends a crafted unauthenticated HTTP request to the vulnerable service functionality with malicious input designed to bypass or abuse validation logic. If the appliance is vulnerable, the input is processed in a way that results in arbitrary command execution on the underlying system. The attacker can then establish persistence, retrieve configuration files, capture credentials or tokens, stage tools, proxy traffic through the appliance, or use the appliance as an internal foothold. In ransomware-related intrusions, this type of edge-device compromise is commonly followed by credential access, internal reconnaissance, lateral movement, privilege escalation, data theft, and deployment of encryption payloads against reachable systems.

How to fix it

Upgrade affected Mitel MiVoice Connect Service Appliance deployments to a vendor-supported fixed release or apply the Mitel-provided security update/hotfix for CVE-2022-29499. The affected range includes MiVoice Connect through 19.2 SP3, including SA 100, SA 400, and Virtual SA appliances. Because no exact fixed version was provided in the input, administrators should verify current Mitel advisories and obtain the appropriate patched build directly from Mitel support. If immediate upgrade is not possible, remove public internet exposure, restrict access to trusted management networks or VPN-only administration, enforce firewall allowlists, block unauthenticated access to appliance management and service interfaces, and monitor for exploitation attempts. For any appliance suspected of compromise, treat patching alone as insufficient: preserve evidence, review logs, rotate credentials and certificates associated with the appliance, rebuild from trusted media if integrity cannot be established, and check for lateral movement.

How to confirm the fix worked

Confirm that all MiVoice Connect Service Appliances are inventoried, including physical SA 100, SA 400, and Virtual SA deployments. Verify the installed software version and confirm it is no longer within the affected range of MiVoice Connect through 19.2 SP3 or that the Mitel security hotfix has been applied. Validate that appliance web and service interfaces are not exposed directly to the internet unless explicitly required and protected. Perform an authenticated administrative version check, review vendor patch status, and run an external exposure scan to confirm only expected ports are reachable. Where safe and authorized, use a non-destructive vulnerability scanner or vendor-provided validation procedure to confirm the vulnerable endpoint no longer accepts crafted unauthenticated input. Review appliance logs before and after remediation for suspicious HTTP requests, command-execution patterns, unexpected outbound connections, unknown files, and modified startup or scheduled-task locations.

Typical attack path

1. Scan the internet or target network for Mitel MiVoice Connect Service Appliance instances, including SA 100, SA 400, and Virtual SA deployments.
2. Confirm appliance exposure and version likelihood using HTTP responses, appliance-specific paths, TLS certificates, or service fingerprints.
3. Send a crafted unauthenticated request to the vulnerable Service Appliance component to trigger remote code execution.
4. Execute basic discovery commands to determine user context, operating system details, network interfaces, and reachable internal services.
5. Download or stage additional tools, scripts, web shells, reverse shells, or tunneling utilities.
6. Harvest configuration data, credentials, logs, certificates, or other sensitive files from the appliance.
7. Use the appliance as a pivot point into internal networks, including voice infrastructure and adjacent enterprise systems.
8. Perform lateral movement, data exfiltration, or ransomware deployment where broader network access is obtained.

How to detect it

Hunt across web server logs, appliance service logs, reverse-proxy logs, firewall logs, EDR telemetry if deployed, DNS logs, NetFlow, and SIEM records for signs of unauthenticated command execution against MiVoice Connect Service Appliances. Focus on unusual HTTP requests to appliance-specific service or script paths, especially requests containing shell metacharacters, encoded commands, command separators, file-download utilities, reverse-shell syntax, or attempts to write files into web-accessible directories. Review logs for requests to diagnostic or service scripts followed by outbound connections from the appliance to unfamiliar external IP addresses. Examine process execution telemetry for web-service parent processes spawning shells, interpreters, download tools, archive utilities, or networking tools. On the appliance, look for recently created or modified files in web roots, temporary directories, startup locations, and scheduled-task locations. Because this vulnerability is known to be exploited in ransomware campaigns, also search for post-exploitation behaviors such as credential dumping, network scanning from the appliance, SMB/RDP/SSH connections initiated by the appliance, unusual authentication failures or successes, data staging, and connections to command-and-control infrastructure. If logs are limited, prioritize network evidence showing inbound exploit-like HTTP requests followed by outbound beaconing or tool retrieval.

• /scripts/vtest.php
• vtest.php?
• %3Bwget%20
• %3Bcurl%20
• ;wget
• ;curl
• bash -c
• /bin/sh -c
• nc -e
• /dev/tcp/
• python -c
• perl -e
• chmod +x
• curl http
• wget http
• /tmp/
• www-data
• apache spawned /bin/sh
• httpd spawned /bin/sh

What your security team should do

• Immediately identify all Mitel MiVoice Connect Service Appliance instances, including SA 100, SA 400, and Virtual SA appliances, across internet-facing and internal networks.
• Prioritize remediation because the vulnerability is in CISA KEV, has active in-the-wild exploitation, has a high EPSS score of 0.55404, and is associated with ransomware activity.
• Upgrade to a Mitel-supported fixed release or apply the vendor hotfix; if the appliance is running MiVoice Connect through 19.2 SP3, assume it is affected until proven otherwise.
• Remove direct internet exposure and restrict appliance access to trusted administrative networks using firewall allowlists or VPN-based access controls.
• Conduct threat hunting for historical exploitation, especially on appliances exposed before patching or before the 2022-07-18 KEV deadline.
• Rotate credentials, API secrets, certificates, and service accounts accessible from or stored on the appliance if exploitation is suspected or cannot be ruled out.
• Review outbound network telemetry from the appliance for connections to unknown external hosts, especially after suspicious HTTP requests.
• Inspect the appliance for unexpected files, web shells, new user accounts, modified startup entries, cron jobs, or unusual processes.
• If compromise is confirmed, rebuild the appliance from trusted media or vendor images rather than relying only on cleanup.
• Expand investigation to adjacent systems for lateral movement, credential misuse, data staging, and ransomware precursors.