PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-41223 Mitel CVE debrief

CVE-2022-41223 is a code injection vulnerability affecting Mitel MiVoice Connect. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-02-21 and marked it as having known ransomware campaign use, which makes it a high-priority remediation item for any affected environment.

Vendor
Mitel
Product
MiVoice Connect
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2023-02-21
Original CVE updated
2023-02-21
Advisory published
2023-02-21
Advisory updated
2023-02-21

Who should care

Organizations running Mitel MiVoice Connect, especially teams responsible for voice/UC infrastructure, patch management, and incident response.

Technical summary

The issue is described as a code injection vulnerability in Mitel MiVoice Connect. The supplied authoritative sources identify it as known exploited by CISA and note known ransomware campaign use, but the corpus does not include exploit details, affected version ranges, or remediation specifics beyond applying vendor updates.

Defensive priority

Urgent. This vulnerability is in CISA’s Known Exploited Vulnerabilities catalog and carries known ransomware campaign use, so affected systems should be prioritized for immediate remediation.

Recommended defensive actions

  • Apply updates per vendor instructions as directed by CISA and Mitel.
  • Inventory all MiVoice Connect deployments and confirm whether any instances are affected.
  • Prioritize internet-exposed or externally reachable systems for immediate review and patching.
  • Review the vendor security advisory and NVD record for any environment-specific guidance.
  • Monitor related systems for suspicious configuration changes, unexpected execution, or other signs of compromise.
  • Validate that remediation was completed before the KEV due date and document any residual risk.

Evidence notes

This debrief is based only on the supplied CISA KEV record, CVE metadata, and official resource links. The corpus confirms the vulnerability name, product, KEV listing date, due date, and known ransomware campaign use, but does not provide exploit mechanics, affected versions, or technical remediation details beyond applying vendor updates.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-41223 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-41223

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-41223 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-41223

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.