CVE-2022-29499

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Aug 6, 2026

Description

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499US Government Resource

Timeline

Published: Apr 26, 2022
Last modified: Aug 6, 2026
Added to CISA KEV: Jun 27, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-29507.8Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of H3D CVE-2022-295008.8SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.CVE-2022-295018.8SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution.CVE-2022-295029.8SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges.CVE-2022-295039.8A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread alloca CVE-2022-295057.8Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege CVE-2022-295067.8Out-of-bounds read vulnerability exist in the simulator module contained in the graphic editor 'V-SFT' v6.1.3.0 and earlier, which may allow CVE-2022-295075.5Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potenti CVE-2022-295087.8Null pointer dereference in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escal CVE-2022-295097.5Directory traversal vulnerability in T&D Data Server (Japanese Edition) Ver.2.22 and earlier, T&D Data Server (English Edition) Ver.2.30 and CVE-2022-29517.8Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to improper validation of array index vulnerability during processing CVE-2022-295106.7Improper buffer restrictions in some Intel(R) Server Board M10JNP2SB BIOS firmware before version 7.219 may allow a privileged user to poten