CVE-2022-41223 Mitel MiVoice Connect Code Injection

Exploited in the wild Medium 6.8 Published 22 Nov 2022 Updated 21 Oct 2025

An authenticated attacker can execute arbitrary code in the MiVoice Connect Director database by injecting crafted data due to insufficient type restrictions.

Exploited in the wild: Since 21 Feb 2023
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-41223?

CVE-2022-41223 is a medium-severity code injection vulnerability in n/a, published on 22 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

Weakness: CWE-94

Which versions are affected by CVE-2022-41223?

It affects 1 product.

Products include Mitel Mivoice Connect.

How do I fix CVE-2022-41223?

No fix has been published for CVE-2022-41223 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Mar 2023.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-41223 being exploited?

Yes. Attackers have exploited CVE-2022-41223 in the wild since at least 21 Feb 2023, including in ransomware campaigns.

Sources

Also known as GHSA-7vhc-x99q-vfpj.