CVE-2022-29499
Mitel MiVoice Connect Data Validation Vulnerability
CVSS
9.8
Critical
EPSS
55.2%
p99
KEV
YES
Jun 27, 2022
Exploit Today
80
0-100
Published: Apr 26, 2022 · Last modified: Aug 6, 2026 · CWE-20
54.3%EPSS · 30 days55.6%
2026-09-162026-10-14
Product
Mitel / MiVoice Connect
Vulnerability
Mitel MiVoice Connect Data Validation Vulnerability
Added to KEV
Jun 27, 2022
Remediate by
Jul 18, 2022
Known ransomware use
Yes
Summary description
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2022-29499
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
- www.mitel.comhttps://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002
- www.mitel.comhttps://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-77470——
———Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.4hCVE-2026-77466——
———Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.5hCVE-2026-1003475.3 MED—
———kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.6hCVE-2026-798377.3 HIG—
———A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.6hCVE-2026-798366.4 MED—
———A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure.6hCVE-2026-798352.8 LOW—
———A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.6h