CVE-2022-41223

This vulnerability is like a “smart door” in your phone/business communications system database that’s supposed to only accept safe inputs, but doesn’t properly restrict what it will process. If someone gets an authenticated user account, they can feed the system specially crafted data so it can run attacker code. Because it’s been used in ransomware activity, leaving it unpatched raises the odds your system could be compromised and disrupted.

This matters if your small business runs or manages MiVoice Connect, especially the Director database component on versions up to 19.3 (22.22.6100.0). The attacker path requires authentication, meaning it’s mainly a risk if an attacker can log in (for example via stolen credentials, weak passwords, or an exposed management interface). The real-world risk is higher because it’s been included in CISA KEV for ransomware use.

This is RED because the vulnerability is confirmed in CISA KEV as being used in ransomware campaigns, meaning attackers have treated it as a reliable path to compromise. Mitigation requires applying the vendor’s updates—waiting increases the time window for criminals to target your system if they can authenticate.

1. Confirm affected deployment

   • Identify whether you are running MiVoice Connect.
   • Check the installed MiVoice Connect version for the Director database component.
   • If you are at or below 19.3 (22.22.6100.0), you should treat the system as potentially vulnerable.

2. Get the authoritative fix guidance

   • Use Mitel’s security advisories page and open Mitel Product Security Advisory 22-0008.
   • Follow the vendor’s exact upgrade steps (including any prerequisites, service stop/start order, and post-upgrade checks).

3. Upgrade to the vendor-fixed version

   • Apply the Mitel-recommended update path to reach the fixed release(s) specified in the advisory.
   • After upgrading, validate that the Director database component is on the corrected version and that the service is functioning normally.

4. If patching is delayed (temporary risk reduction)

   • Reduce access to MiVoice Connect accounts: disable unused accounts, enforce strong passwords, and ensure only approved users can authenticate.
   • Limit network reachability to the MiVoice Connect environment (e.g., avoid exposing management interfaces to the public internet) according to your operational constraints and the advisory’s guidance.

5. Due date / reporting expectation

   • CISA KEV lists a remediation due date of 2023-03-14; treat this as already overdue for any systems still on the affected version range.

6. What to monitor after changes

   • Monitor for authentication anomalies (unexpected logins) and operational disruption (service restarts/crashes).
   • Confirm system health and stability after the upgrade steps are complete.

Severity context: The reported CVSS score is 6.8 (Medium), but real-world impact is elevated by confirmed ransomware use.

Weakness and mechanism: This is a code-injection issue (CWE-94). The affected “Director database component” could be tricked by crafted data because it lacks sufficient restrictions on the database data type, enabling an authenticated attacker to inject and execute malicious code.

Exploitation status: The vulnerability is listed in CISA KEV (added 2023-02-21) as having been used in ransomware campaigns, with a required action of applying vendor updates.

Exploit availability: No public exploit code is recorded in the provided findings, which does not reduce risk given KEV confirmation.

EPSS: A prediction indicates high likelihood and a rising trend, but public-facing guidance here is driven by KEV confirmation rather than EPSS.

Patch information: Vendor remediation is available via Mitel’s security advisories, specifically Mitel Product Security Advisory 22-0008.