Mitel · MiVoice Connect

CVE-2022-40765

Mitel MiVoice Connect Command Injection Vulnerability

Exploited in attacks Used by ransomware Medium 6.8 Attack chance: 11%

What it is

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

CISA: The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: March 14, 2023

Added to the CISA list: February 21, 2023
Published: November 22, 2022
Severity: Medium 6.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 11% in the top 4.2% of all known vulnerabilities
Weakness: CWE-77
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Mitel

Added	Vulnerability	Product	Severity	Attack chance
Feb 21, 2023	Code InjectionCVE-2022-41223used by ransomware	MiVoice Connect	Medium 6.8	11%
Jun 27, 2022	Data ValidationCVE-2022-29499used by ransomware	MiVoice Connect	Critical 9.8	55%
Feb 12, 2025	Argument InjectionCVE-2024-41710	SIP Phones	Medium 6.8	42%
Jan 7, 2025	Path TraversalCVE-2024-41713used by ransomware	MiCollab	Critical 9.1	97%
Jan 7, 2025	Path TraversalCVE-2024-55550used by ransomware	MiCollab	Medium 4.4	38%
Mar 25, 2022	Access ControlCVE-2022-26143	MiCollab, MiVoice Business Express	Critical 9.8	87%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.