CVE-2022-41223: Mitel MiVoice Connect Code Injection Vulnerability

CVE-2022-41223 is a code injection vulnerability affecting the Director component of Mitel MiVoice Connect. An authenticated attacker who already has internal network access can execute code within the context of the application.

This matters for IT and security teams because code execution on a telephony or unified-communications platform can enable lateral movement, data access, or further compromise. Public reporting indicates the vulnerability has been used in ransomware activity, so prompt inventory and remediation are warranted.

How it works

The weakness is classified as CWE-94 (Improper Control of Generation of Code, or Code Injection). In this class of flaw, an application fails to properly neutralize or restrict code that is supplied as input, allowing that input to be interpreted and executed by the runtime or interpreter used by the software.

According to the available summary, the Director component of Mitel MiVoice Connect can be abused by an authenticated attacker who has reached the internal network. The attacker supplies crafted input that the component processes as code, resulting in execution under the privileges of the application. Exact injection vectors, request formats, or required privileges beyond authentication and internal access are not detailed here; teams must confirm those mechanics against the vendor advisory.

Am I affected? How to find it in your systems

Mitel MiVoice Connect is a unified-communications and telephony platform commonly deployed on-premises or in hybrid environments to provide voice, messaging, and related services. The vulnerable surface is specifically the Director component.

• Inventory all instances of Mitel MiVoice Connect in your environment, including production, lab, and disaster-recovery systems. Check asset-management records, CMDB entries, and network scans for hosts running MiVoice Connect services.
• Identify whether the Director component is installed and reachable from internal networks. Confirm the exact software versions and patch levels against the vendor advisory, because public detail on affected builds is limited here.
• Review authentication and network-access controls that protect the Director interface; the attack requires authentication plus internal reachability.
• Examine application, system, and authentication logs for anomalous activity around the Director component—unexpected process launches, unusual command execution, or authentication events from unexpected internal sources. Telemetry from EDR or network monitoring that shows code-execution patterns on those hosts should also be reviewed. Absence of clear indicators does not prove safety; confirm version status with the vendor.

How to remediate

The primary action is to apply the updates published by Mitel for MiVoice Connect, following the vendor’s instructions exactly. CISA guidance likewise directs organizations to apply updates per the vendor.

• Obtain the official advisory and fixed packages directly from Mitel; do not rely on third-party summaries for version numbers or install steps.
• Test the update in a non-production environment that mirrors your Director configuration, then schedule a controlled production rollout.
• After patching, re-verify that the Director component reports the expected fixed state and that authentication and network controls remain intact.
• As hardening for the code-injection class, ensure the application runs with least privilege, that input-validation and output-encoding controls are enabled where configurable, and that unnecessary administrative interfaces are disabled or tightly restricted.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls focused on the requirements of this vulnerability: authentication and internal network access.

• Segment the MiVoice Connect / Director hosts so they are reachable only from a tightly controlled management network or jump hosts; block broader internal access at firewalls or micro-segmentation policy.
• Enforce strong authentication (preferably multi-factor) and limit the number of accounts that can reach the Director interface.
• If a web application firewall or reverse-proxy sits in front of the component, apply virtual-patching rules that restrict unexpected input patterns; validate any such rules against the vendor’s description of the issue.
• Disable or restrict any non-essential Director features or remote-management functions that are not required for operations.
• Increase monitoring and alerting on the affected hosts for process creation, command-line activity, and authentication anomalies; retain logs for forensic review.

If your data may have been exposed

Actively exploited vulnerabilities, including those used in ransomware campaigns, frequently lead to data theft or further compromise. If you determine that an unpatched Director instance was reachable by authenticated internal users, treat the host as potentially compromised: isolate it, preserve forensic evidence, and follow your incident-response plan. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or personal information have already appeared in public dumps.