CISA adds IBM Aspera Faspex and Mitel MiVoice to Known Exploited Vulnerabilities Catalog

CVE-2022-41223 is a code-injection flaw (CWE-94) in the Director database component of Mitel MiVoice Connect through version 19.3 (22.22.6100.0), caused by insufficient restrictions on database data types. An attacker who is already authenticated with high-privilege access to the affected component can submit specially crafted data that is injected and executed. Successful exploitation yields high-impact results — confidentiality, integrity, and availability of the system can all be compromised — and CISA notes it has seen known ransomware use. All organizations running Mitel MiVoice Connect with Director at or below the affected build are potentially exposed, with the practical attack surface limited to those who can reach the Director interface (the CVSS vector is adjacent-network with high privileges required). The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-02-21 with ransomware use confirmed, but no public proof-of-concept is known, so defenders should assume active exploitation.

Do: Apply the vendor-supplied update for MiVoice Connect per Mitel's instructions, ensuring Director is running a build later than 19.3 (22.22.6100.0). Until patched, restrict access to the Director web component to trusted admin networks, review and harden high-privilege account credentials, and monitor for signs of exploitation given confirmed ransomware use. Check with your Mitel reseller or the vendor advisory for the exact fixed version applicable to your deployment.

IBM Aspera Faspex, an enterprise high-speed file transfer platform, contains a deserialization flaw (CWE-502) that allows a remote attacker to execute code on the server by supplying crafted input that the application insecurely deserializes as YAML. An attacker who can reach the Faspex application can trigger the flaw and run arbitrary code in the context of the application, potentially leading to full compromise of the hosting server. Any organization running IBM Aspera Faspex is affected, with internet-exposed deployments at greatest risk since they provide direct reachability to the vulnerable application. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-02-21 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (top percentile). No public proof-of-concept is catalogued, but confirmed in-the-wild exploitation makes patching urgent.

Do: Apply IBM's update for Aspera Faspex per vendor instructions as the required action, prioritizing any Faspex instance reachable from the internet; restrict network access (firewall/VPN) until patched. Because ransomware actors have used this flaw, also review Faspex servers for signs of compromise, such as unexpected processes spawned by the application, anomalous requests to Faspex application endpoints, or new accounts and persistence mechanisms.