Mitel · MiVoice Connect
CVE-2022-40765
Mitel MiVoice Connect Command Injection Vulnerability
Qué es
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
CISA: The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 14 de marzo de 2023
Más fallos explotados de Mitel
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 21 feb 2023 | Code Injection | MiVoice Connect | Media 6,8 | 11% |
| 27 jun 2022 | Data Validation | MiVoice Connect | Crítica 9,8 | 55% |
| 12 feb 2025 | Argument Injection | SIP Phones | Media 6,8 | 42% |
| 7 ene 2025 | Path Traversal | MiCollab | Crítica 9,1 | 97% |
| 7 ene 2025 | Path Traversal | MiCollab | Media 4,4 | 38% |
| 25 mar 2022 | Access Control | MiCollab, MiVoice Business Express | Crítica 9,8 | 87% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.