Aperçu
Mitel MiVoice Connect contains a remote code execution vulnerability in the Service Appliance component caused by incorrect data validation. This vulnerability allows remote attackers to execute arbitrary code with network access to the affected system. La vulnérabilité a été divulguée le April 26, 2022. CISA a identifié CVE-2022-29499 comme étant exploitée et est connue pour être utilisée dans des campagnes de rançongiciel.
Détails techniques
The vulnerability exists in the Service Appliance component of Mitel MiVoice Connect due to improper validation of input data. An attacker can send specially crafted network requests to exploit this validation flaw, leading to arbitrary code execution on the affected system with the privileges of the Service Appliance process.
La vulnérabilité est classifiée comme CWE-20 (Improper Input Validation) etCWE-94 (Improper Control of Generation of Code ('Code Injection')) .
La vulnérabilité a reçu un score de base CVSS v3.1 de 9.8 (CRITICAL) avec la chaîne vectorielle CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indiquant sa nature critical.
Impact
Successful exploitation allows remote attackers to execute arbitrary code on the affected system with no authentication required. This can lead to complete compromise of the MiVoice Connect infrastructure, including potential theft of sensitive communications data, modification of call routing configurations, denial of service, lateral movement to other systems, and installation of persistent backdoors.
Mitigation et contournements
Update MiVoice Connect to version 20.0 SP1 or later. For organizations unable to immediately upgrade, apply the appropriate security patch from Mitel or implement the network segmentation controls outlined below. Les versions suivantes incluent les correctifs nécessaires : MiVoice Connect 20.0 SP1, MiVoice Connect 20.1 and later.
Comme contournements temporaires : implement network segmentation to restrict access to the mivoice connect service appliance to trusted networks only. use firewalls to limit connectivity to the service appliance ports.; deploy intrusion detection/prevention systems (ids/ips) to monitor for and block exploitation attempts targeting this vulnerability., et implement web application firewalls (waf) with rules to detect and block malicious input patterns targeting the service appliance component..
Recommandation de CISA : Apply updates per vendor instructions.
Ressources additionnelles
Source : Ce rapport a été généré par IA
