CVE-2022-41223 is a code injection vulnerability in Mitel MiVoice Connect. CISA added it to the Known Exploited Vulnerabilities catalogue on 21 February 2023, which means attackers have used it in real attacks. The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
What Mitel MiVoice Connect code injection means
Code injection in a communications platform means an attacker can supply input that the application processes as executable behaviour, rather than as data. In a product like Mitel MiVoice Connect, that turns a management or directory feature into a direct execution path inside the application boundary.
Because the primary definition says the Director component allows an authenticated attacker with internal network access to run code in the application context, the vulnerability is especially serious in environments where administrative interfaces are reachable from broad internal segments or poorly segmented remote access zones.
Why this vulnerability is dangerous in a voice platform
VoIP and unified communications systems often sit close to user directories, call routing, voicemail, and operational management functions. If an attacker can inject code into a control-plane component, they may be able to manipulate service behaviour, harvest configuration data, or use the platform as a foothold for further internal movement.
This is why code injection in a management-facing component is more than a software bug, it is an integrity and trust failure. The service may appear to operate normally while the attacker runs commands in the background or alters data paths that operators rely on for visibility and control.
How organisations assess exposure and exposure paths
Exposure review starts with confirming whether Mitel MiVoice Connect is deployed anywhere in the environment, which versions are running, and whether the Director interface is reachable from internal networks, VPN ranges, or shared administration segments. Asset inventory matters because organisations often discover communications platforms outside standard server ownership boundaries.
Authoritative version and remediation details should be checked against the CVE Program record and the NIST National Vulnerability Database, then cross-checked with the vendor advisory. CISA’s KEV listing is the operational signal that this weakness has been used in real-world attacks and should be prioritised accordingly.
Remediation, detection, and post-incident review
Remediation should follow the vendor’s guidance as the authoritative source for affected and fixed versions, but when patching is delayed, organisations should reduce reachable attack surface, restrict administrative access, and isolate the platform behind tighter network controls. Compensating controls are especially important when the vulnerable component is exposed to a wide internal trust zone.
Detection should look for unexpected code execution, unusual child processes, suspicious administrative activity, and changes to the normal behaviour of the Director component. After patching, teams should review whether the platform was already compromised before the fix, because a KEV-listed code injection issue may have been exercised long before defenders noticed.
Where exploitation is suspected, rotate credentials or service secrets that may have been accessible from the compromised application context, and validate whether adjacent systems accepted traffic or administrative actions originating from the platform. The Vulnerability Management Guide is useful for prioritising KEV-listed flaws, while Gladinet Hard-Coded Keys RCE Exploitation and ASP.NET machine key attacks 2025 show how code execution flaws often become a path to broader compromise.
Risk and Threat Considerations
When an authenticated internal user can turn a trusted management component into code execution, the main risk is not just exploitation, it is the collapse of the boundary between legitimate administration and attacker activity. In internal networks, that can make compromise harder to spot and easier to extend into adjacent systems.
Failure mechanism: The attacker abuses a code injection path in the Director component to run commands in the application context, then leverages that position to alter service behaviour, access sensitive data, or pivot deeper into the environment.
Impact: The result can include system compromise, loss of integrity in call or directory functions, credential exposure, and a wider internal breach if the communications platform is connected to other trusted services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Asset inventory is needed to find deployed MiVoice Connect instances and reachable Director services. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Hardening and exposure reduction directly mitigate internal reachability and misuse of the vulnerable component. | |
| CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation requires prioritisation, verification, and remediation tracking for this CVE. | |
| Recommendation — Inventory all MiVoice Connect assets and identify every exposed management path. Harden the platform and restrict the Director interface to the smallest necessary trust zone. Prioritise, remediate, and verify the CVE using a KEV-driven vulnerability workflow. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | The issue is code injection through application input handling, which maps directly to input validation controls. |
| SC-7 — Boundary Protection | Internal network access is part of the attack condition, so segmentation and access boundaries materially affect exposure. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection and compromise review rely on analyzing logs for exploitation and follow-on activity. | |
| Recommendation — Validate and constrain application inputs that reach the Director component. Limit reachability of the vulnerable service with strict boundary controls and segmentation. Review audit records for signs of exploitation and suspicious post-compromise activity. | ||
| OWASP ASVS | V15 — Secure Architecture | Code injection reveals an architectural trust failure between input handling and execution behavior. |
| Recommendation — Design application paths so untrusted input cannot influence execution flow. | ||
Practitioner Guidance
Why practitioners should care: A KEV-listed code injection issue in a communications platform should be treated as a high-priority exposure, not a routine application defect, because it can deliver execution inside a trusted operational system.
What to watch for: Confirm whether the Director component is reachable from any user-accessible internal network, whether compensating controls exist for delayed patching, and whether post-patch review has been completed if exploitation may have occurred.
Practitioner takeaway: Prioritise remediation based on real exploitability, then verify whether the system was already used as a foothold before the fix was applied.