Vulnerability record · CVE-2022-40765 · published 22 November 2022
CVE-2022-40765: Mitel MiVoice Connect Edge Gateway command injection
Mitel · Mivoice Connect
Mitel MiVoice Connect through 19.3 (22.22.6100.0) contains a command-injection flaw in the Edge Gateway component caused by insufficient restriction of URL parameters. An attacker who already holds credentials and can reach the internal network can inject commands through those parameters, which matters because it gives a foothold into a communications platform and the CISA KEV entry notes known ransomware campaign use.
Description
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw is in CISA KEV with known ransomware use and a high EPSS percentile, but exploitation requires authenticated internal access, which limits reach.
What it is
Mitel MiVoice Connect through 19.3 (22.22.6100.0) contains a command-injection flaw in the Edge Gateway component caused by insufficient restriction of URL parameters. An attacker who already holds credentials and can reach the internal network can inject commands through those parameters, which matters because it gives a foothold into a communications platform and the CISA KEV entry notes known ransomware campaign use.
Impact
An authenticated attacker with internal network access can execute arbitrary commands on the Edge Gateway, leading to compromise of the appliance and potential lateral movement into the MiVoice Connect environment.
Attack surface
The flaw is reached over the internal network via the Edge Gateway's URL parameters, per the CVSS vector AV:A. It requires high privileges (PR:H) and no user interaction (UI:N), so an attacker must already have valid credentials and internal access.
Exploitation
CVE-2022-40765 is listed in CISA KEV with a due date of 2023-03-14 and known ransomware campaign use, and EPSS shows a 30-day probability of roughly 10.5 percent (95.5th percentile). References are vendor advisories and the CISA KEV entry; no public exploit code is cited in the record.
What to do
- Apply the vendor updates referenced in Mitel security advisory 22-0007 for MiVoice Connect Edge Gateway.
- Restrict internal network access to the Edge Gateway management and URL endpoints to trusted hosts only.
- Review and minimize accounts with the high privileges needed to reach the vulnerable parameters.
- Monitor for and block command-injection patterns in requests to Edge Gateway URL parameters.
- Treat the Edge Gateway as a high-value target in ransomware defense planning given the KEV listing.
Detection
- Inspect Edge Gateway and web/proxy logs for URL parameters containing shell metacharacters or command separators.
- Alert on unexpected child processes or command execution spawned by the Edge Gateway service.
- Monitor for anomalous outbound connections or new processes on the Edge Gateway host.
- Correlate authentication events with subsequent command execution activity on the appliance.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-40765 to the Known Exploited Vulnerabilities catalog on 21 February 2023 as "Mitel MiVoice Connect Command Injection Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 14 March 2023.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.mitel.com/support/security-advisories | Vendor Advisory |
| https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007 | MitigationVendor Advisory |
| https://www.mitel.com/support/security-advisories | Vendor Advisory |
| https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007 | MitigationVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40765 | US Government Resource |
Track CVE-2022-40765 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-40765), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
