How to Fix CVE-2022-41223: Security Vulnerability in MiVoice Connect

Upgrade Director per Mitel advisory 22-0008. CVE-2022-41223 is an authenticated code-injection flaw (CWE-94) in the Director database component of MiVoice Connect through 19.3 (build 22.22.6100.0). CISA listed it in the Known Exploited Vulnerabilities catalog on 2023-02-21 with a federal remediation deadline of 2023-03-14, so even though the base score is a medium 6.8, this is a patch-now item.

What is CVE-2022-41223?

CVE-2022-41223 is a code-injection vulnerability in Mitel MiVoice Connect, the on-premises unified-communications platform formerly sold under the ShoreTel name. The flaw lives in the Director database component — the administrative management layer that configures the phone system. MITRE published the record on 2022-11-22.

The exact wording from the advisory: “The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.”

In plain terms, Director does not properly constrain the data type of values written to its database. An authenticated user who supplies crafted input can smuggle code through that gap, and Director ends up generating and executing attacker-controlled code instead of treating the input as inert data. That is the textbook shape of CWE-94, Improper Control of Generation of Code (‘Code Injection’). The CVSS vector confirms the impact is total once the conditions are met: confidentiality, integrity, and availability are all rated HIGH (C:H/I:H/A:H), with scope unchanged.

Who can exploit it, and from where

Read the CVSS 3.1 vector carefully before you panic about internet exposure: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 6.8.

• AV:A — Adjacent network. The attacker must be on the same logical or physical network segment as Director, not anywhere on the public internet. This is why the score stops at medium despite total impact.
• PR:H — High privileges required. The attacker must already be authenticated to Director with elevated rights. This is not a pre-auth, drive-by exploit. The practical threat is a malicious or compromised administrator account, or an attacker who has already pivoted onto the voice/management VLAN and captured Director credentials.
• UI:N — No user interaction. Once the attacker meets the access conditions, no admin needs to click anything.

The takeaway: this is not a CVE you mitigate purely with a perimeter firewall, because the attack path is internal and authenticated. The real exposure is anyone who can reach the Director management interface and hold (or steal) a privileged account.

Why this matters

CISA added CVE-2022-41223 to the Known Exploited Vulnerabilities catalog on 2023-02-21. That listing exists because confirmed in-the-wild exploitation was reported. Federal civilian agencies are bound by Binding Operational Directive 22-01 to remediate by 2023-03-14, and most enterprises treat the KEV deadline as a practical floor.

For a PBX, code injection in the management layer is worse than it sounds. A compromised MiVoice Connect Director can be used to reconfigure call routing, exfiltrate the dial plan and user directory, stand up toll-fraud routes, or pivot deeper into the corporate network the voice system touches. Because Director is the configuration brain of the deployment, integrity and availability of the entire phone system ride on it.

Am I affected?

You are affected if your MiVoice Connect Director runs release 19.3 (build 22.22.6100.0) or earlier. To check your build:

• Log in to the MiVoice Connect Director web administration interface.
• Open the About / system information panel and note the running release and build number.
• Compare it against the fixed build named in Mitel Product Security Advisory 22-0008.

Inventory every Director instance, including lab, staging, and disaster-recovery copies that may have been stood up and forgotten. Each one with a privileged account reachable on the network is in scope.

How to fix CVE-2022-41223

There is no OS package to upgrade here. MiVoice Connect is a vendor-distributed appliance/software platform, so the fix is a Mitel-supplied Director software update, not an apt or dnf command. Follow Mitel’s upgrade path:

1. Open Mitel Product Security Advisory 22-0008 (linked in References). It names the remediated release and any product-specific upgrade notes. Mitel distributes the patched software to customers with an active support entitlement through the Mitel support/MiAccess portal.
2. Take a full configuration backup of Director before touching it. In Director, export the configuration/database backup so you can roll back if the upgrade misbehaves.
3. Schedule a maintenance window. A Director upgrade affects the management plane and can interrupt provisioning and, depending on your topology, call control. Coordinate with the business.
4. Apply the Mitel-provided update to the build named in advisory 22-0008, following Mitel’s documented MiVoice Connect upgrade procedure for your version.
5. Restart the Director services / server as the Mitel upgrade procedure directs.
6. Confirm the new build in Director’s About panel matches the fixed version (see verification below).
7. Hunt for prior compromise. Because this CVE is KEV-listed and exploitation requires an authenticated admin, review Director admin login history for unfamiliar accounts or logins, audit administrator account list and privilege levels, and check for unexpected configuration changes (call routing, trunks, new admin users) made during the exposure window.

Verify the fix landed

• Version check. In MiVoice Connect Director, open the About / system information panel and confirm the running release/build matches the fixed build from advisory 22-0008 (i.e., later than 19.3 / 22.22.6100.0).
• Re-scan. Run your vulnerability scanner (Nessus, Qualys, Tenable, Rapid7) against the Director host. It should no longer flag CVE-2022-41223.
• Functional check. Validate that call control, provisioning, and voicemail still operate after the upgrade, and that your Director backup restores cleanly if you ever need it.

If you can't upgrade immediately

Mitel advisory 22-0008 is the authoritative source for any vendor-sanctioned interim mitigation. Because the attack requires an authenticated, adjacent-network attacker with high privileges, you can meaningfully shrink the attack surface while you schedule the upgrade:

• Restrict Director management access. Limit reachability of the Director administration interface to a dedicated, trusted management VLAN. Do not expose Director administration to general user networks or the internet.
• Tighten administrator accounts. Remove unused or stale admin accounts, enforce strong unique credentials, and apply least privilege so fewer accounts hold the high-privilege role this exploit needs.
• Monitor Director logins. Alert on administrative authentication from unexpected hosts and on out-of-band configuration changes.

None of these replace the fixed build. They only reduce the window of risk until you apply the Mitel update.

Frequently asked questions

Which versions of MiVoice Connect are affected by CVE-2022-41223?

The flaw affects the Director database component of Mitel MiVoice Connect through release 19.3, which is build 22.22.6100.0, and earlier. Mitel published the fixed release in Product Security Advisory 22-0008; check your Director build against that advisory and upgrade to the version it names.

Can an unauthenticated attacker exploit CVE-2022-41223?

No. The CVSS 3.1 vector is CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. PR:H means the attacker already needs high privileges, and AV:A means they must be on the adjacent network rather than the open internet. It is an authenticated code-injection flaw, not a pre-auth remote exploit.

Why is a medium-severity CVE (6.8) on the CISA KEV list?

CVSS measures theoretical impact; KEV reflects observed exploitation. CISA added CVE-2022-41223 to the Known Exploited Vulnerabilities catalog on 2023-02-21 because confirmed in-the-wild exploitation was reported, so the federal remediation deadline of 2023-03-14 applies regardless of the 6.8 base score.

Is there a workaround if I cannot upgrade Director immediately?

Mitel's advisory 22-0008 is the authoritative source for any interim mitigation. Because the attack requires an authenticated adjacent-network attacker, restricting Director administrative access to a trusted management VLAN, removing unused admin accounts, and tightening account privileges reduce exposure. None of these replace the vendor-fixed build.

References

• Mitel Product Security Advisory 22-0008: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008
• Mitel security advisories index: https://www.mitel.com/support/security-advisories
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-41223
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV entry: "Mitel MiVoice Connect Code Injection Vulnerability" - added 2023-02-21

Assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other actively exploited CVEs from the same period worth reviewing alongside this one:

• How to Fix CVE-2022-31199: Remote Code Execution in Auditor
• How to Fix CVE-2022-43769: Critical Vulnerability in Pentaho Business Analytics Server
• How to Fix CVE-2022-26871: Remote Code Execution in Trend Micro Apex Central
• How to Fix CVE-2022-24990: Security Vulnerability in TerraMaster NAS
• How to Fix CVE-2022-26485: Use-After-Free in Firefox