CVE-2022-41223

An authenticated internal attacker could execute code in Mitel MiVoice Connect via CVE-2022-41223, a vulnerability actively exploited in the wild and linked to ransomware.

Mitel MiVoice Connect suffered a code injection flaw allowing authenticated internal attackers to execute arbitrary code within the application context. This failure is critical for DIB organizations because it was actively exploited in the wild and linked to ransomware campaigns, indicating severe negligence and avoidability. Organizations must ensure all Mitel systems are patched and isolated from internal networks to prevent similar compromises.

Shame score — The vulnerability was actively exploited in the wild and linked to ransomware, demonstrating severe negligence and avoidability.