CVE-2022-41223

What it actually does

CVE-2022-41223 is an authenticated code-injection vulnerability in the Director database component of Mitel MiVoice Connect versions through 19.3 / 22.22.6100.0. The flaw is caused by insufficient restrictions on database data types, allowing a highly privileged authenticated attacker with adjacent network access to submit crafted data that is interpreted as executable logic rather than inert data. Successful exploitation can result in arbitrary code execution in the context of the vulnerable MiVoice Connect Director/database component, with potential compromise of confidentiality, integrity, and availability of the voice communications management platform.

Why it matters to the business

A successful attack can give an intruder control over a business-critical phone system management component, potentially enabling call disruption, unauthorized configuration changes, access to sensitive communications metadata, and a foothold for broader internal compromise. This vulnerability is listed in CISA KEV, has been observed in active exploitation, and is associated with ransomware activity, which materially increases urgency even though exploitation requires authentication and network proximity. Organizations running affected Mitel MiVoice Connect versions should treat remediation as time-sensitive; CISA’s KEV remediation deadline was 2023-03-14.

How an attack unfolds

An attacker first obtains valid high-privilege credentials for MiVoice Connect Director or an account with access to the vulnerable database-backed management functionality. Because the CVSS vector requires adjacent network access, the attacker must also be able to reach the relevant MiVoice Connect management interface or database path from the same local, VPN, or otherwise adjacent network segment. The attacker then submits specially crafted data that abuses weak database data-type restrictions. Instead of being handled purely as data, the crafted value is processed in a way that enables code injection. If successful, the attacker can execute commands or logic with the privileges of the affected Director/database component, alter telephony configuration, access sensitive system data, deploy persistence, or use the compromised server as a staging point for lateral movement. Public reporting and KEV status indicate this class of issue has been exploited in the wild, including in ransomware-related activity, so investigations should not assume exploitation is theoretical.

How to fix it

Upgrade Mitel MiVoice Connect to a vendor-supported release that is not affected by this vulnerability. The affected range is MiVoice Connect through 19.3 / 22.22.6100.0; no exact fixed version was provided in the input, so administrators should obtain the current Mitel advisory and install the recommended patched build or supported successor release. If immediate patching is not possible, restrict access to MiVoice Connect Director and related database/management interfaces to dedicated administrative networks, enforce VPN and MFA for administrative access, remove unnecessary privileged accounts, rotate administrative credentials, review role assignments, and block nonessential lateral access to the MiVoice Connect server. Because this vulnerability is in CISA KEV and associated with ransomware activity, compensating controls should be temporary only.

How to confirm the fix worked

Confirm the installed MiVoice Connect version and build number and verify it is newer than the affected through-19.3 / 22.22.6100.0 range or explicitly listed as fixed by Mitel. Validate that Director and database management interfaces are reachable only from approved administrative networks. Confirm privileged accounts are limited, MFA-protected where supported, and recently rotated if compromise is suspected. After patching, perform an authenticated functional test of MiVoice Connect Director, review database/application logs for injection-related errors, and verify that no unexpected processes, scheduled tasks, services, web-accessible files, or configuration changes were created around the suspected exposure window.

Typical attack path

1. Gain adjacent network access to the MiVoice Connect management environment, such as through VPN, local network presence, or compromise of a nearby host.
2. Obtain or abuse highly privileged MiVoice Connect Director credentials.
3. Authenticate to the MiVoice Connect Director/database-backed management functionality.
4. Submit crafted data that abuses insufficient database data-type restrictions.
5. Trigger code injection and execute attacker-controlled logic in the context of the vulnerable component.
6. Modify MiVoice Connect configuration, access sensitive data, create persistence, or stage additional tooling.
7. Use the compromised system to disrupt voice services, move laterally, or support ransomware deployment.

How to detect it

To determine whether exploitation already occurred, review logs and telemetry from the MiVoice Connect Director server, underlying operating system, database component, web/application layer if applicable, authentication providers, VPN, firewall, and EDR. Focus on periods before patching and around unusual administrative activity. Look for high-privilege Director logins from unusual source addresses, new or rarely used administrator accounts, repeated failed then successful logins, unexpected database type-conversion or syntax errors, abnormal Director configuration changes, and service restarts. On Windows-hosted deployments, inspect Security, System, Application, PowerShell, and Sysmon/EDR events for process creation spawned by Director, web server, database, or service accounts, especially command shells, scripting engines, file download utilities, archive tools, credential dumping tools, or ransomware staging behavior. Review database audit logs for abnormal statements, stored procedure creation/modification, unexpected schema changes, or data values containing command-like strings. Review file system changes for newly created executables, scripts, scheduled tasks, services, or web-accessible files under MiVoice Connect, web server, temporary, or user profile directories. Network teams should inspect firewall/proxy/DNS logs for unusual outbound connections from MiVoice Connect systems after administrative access events. Because no single public exploit string is reliable for this CVE, detection should be behavior-based and correlated across authentication, database, process, file, and network telemetry.

• MiVoice Connect Director
• 22.22.6100.0
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin /transfer
• mshta.exe
• schtasks /create
• New-Service
• xp_cmdshell
• CREATE PROCEDURE
• ALTER PROCEDURE

What your security team should do

• Treat affected MiVoice Connect deployments as high priority because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and is linked to ransomware activity.
• Identify all MiVoice Connect Director deployments and verify whether any are running versions through 19.3 / 22.22.6100.0.
• Upgrade to a vendor-supported fixed Mitel release as soon as possible; if the system is already patched, document the fixed build and patch date.
• Restrict Director and database management access to hardened administrative segments only; block access from general user networks.
• Review and reduce privileged MiVoice Connect accounts; rotate credentials for administrative users and service accounts with access to the vulnerable component.
• Hunt for signs of prior exploitation using Director application logs, database logs, Windows Event Logs, authentication logs, EDR telemetry, and network access records.
• Investigate any privileged Director login followed by database errors, unusual configuration changes, unexpected process execution, or outbound connections from the MiVoice Connect server.
• If suspicious activity is found, preserve forensic images/logs, isolate the affected server from nonessential network access, and initiate incident response before rebuilding or restoring services.