CVE-2022-40765
Mitel MiVoice Connect Command Injection Vulnerability
Description
CVE-2022-40765 is a command injection vulnerability in the Edge Gateway component of Mitel MiVoice Connect through version 19.3 (22.22.6100.0). The flaw stems from insufficient restriction of URL parameters, allowing an authenticated attacker with adjacent network access to inject and execute arbitrary operating system commands on the underlying server. Despite its Medium CVSS rating of 6.8, CVE-2022-40765 has been confirmed by CISA as actively exploited in the wild and is associated with ransomware campaigns, significantly elevating its real-world threat level for organizations relying on Mitel MiVoice Connect for unified communications.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mitel | mivoice connect | <= 22.22.6100.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.mitel.com/support/security-advisories(Vendor Advisory)
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40765(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command (Command Injection)
In Mitel MiVoice Connect, CWE-77 manifests through the Edge Gateway component, which fails to properly sanitize URL parameters before incorporating them into system commands. An authenticated attacker can embed operating system command separators or special characters within URL parameters, causing the server to execute attacker-controlled commands alongside legitimate operations.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command
Impact Analysis
CVE-2022-40765 has a CVSS score of 6.8 (Medium), but its confirmed exploitation in ransomware campaigns makes it a high-priority threat. The vulnerability requires adjacent network access (Attack Vector: Adjacent), restricting exploitation to attackers who are on the same network segment as the MiVoice Connect Edge Gateway. Attack complexity is low, meaning once adjacent access is obtained, exploitation is straightforward with no special conditions. High privileges are required, limiting the attack surface to authenticated users with administrative access. No user interaction is required for exploitation. All three impact metrics — confidentiality, integrity, and availability — are rated High, indicating that successful command injection grants the attacker full control over the affected system, enabling data theft, system manipulation, and service disruption. The EPSS score of 2.4% (85th percentile) indicates moderate baseline exploitation probability, though the CISA KEV listing and ransomware association confirm that real-world exploitation is actively occurring.
Exploit Maturity
CISA has added CVE-2022-40765 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild with a mandatory remediation deadline of March 14, 2023. This vulnerability is associated with known ransomware campaigns, indicating that threat actors are actively targeting Mitel MiVoice Connect deployments as part of broader intrusion operations. While no dedicated public proof-of-concept exploit was found in the available references, the Mitel security advisory (MISA-22-0007) provides mitigation guidance that confirms the exploitability of the command injection flaw. The EPSS score of 2.4% suggests moderate exploitation likelihood, but the confirmed KEV status and ransomware usage warrant treating this as an immediate priority.
Remediation
- Apply Mitel security patches immediately. Follow the guidance in Mitel Product Security Advisory 22-0007 to update MiVoice Connect to a version that resolves the command injection vulnerability in the Edge Gateway component. CISA requires remediation by 2023-03-14.
- Upgrade MiVoice Connect beyond version 19.3. Ensure your MiVoice Connect installation is updated past version 19.3 (build 22.22.6100.0), as all versions through this release are confirmed vulnerable to command injection via the Edge Gateway.
- Restrict network access to the Edge Gateway. Implement strict network segmentation to limit adjacent network access to the Edge Gateway component. Only authorized management systems should be able to reach the administration interfaces, and access from untrusted network segments should be blocked at the firewall level.
- Implement URL parameter validation and input filtering. As an interim measure, deploy web application firewall (WAF) rules or reverse proxy configurations that detect and block command injection patterns in URL parameters targeting the Edge Gateway component.
- Monitor for indicators of compromise. Review Edge Gateway logs and system audit trails for unusual URL parameter patterns, unexpected process executions, or signs of command injection attempts. Check for unauthorized accounts, persistence mechanisms, or file encryption activity that may indicate ransomware deployment following exploitation.
Technical Details
CVE-2022-40765 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) and targets the Edge Gateway component of Mitel MiVoice Connect through version 19.3 (22.22.6100.0). The vulnerability arises from insufficient restriction and sanitization of URL parameters that are passed to system-level command execution functions within the Edge Gateway. An authenticated attacker on the adjacent network can craft URL parameters containing command separators or shell metacharacters that break out of the intended command context and execute arbitrary operating system commands. The CVSS vector (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that while adjacent network proximity and high-privilege authentication are prerequisites, the actual exploitation is low complexity and requires no user interaction. The scope remains unchanged, confining the impact to the vulnerable system, but all three CIA triad dimensions are fully compromised — granting the attacker complete control over the affected server with the privileges of the Edge Gateway process.
Frequently Asked Questions
Is CVE-2022-40765 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2022-40765 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 14, 2023. This vulnerability is also associated with known ransomware campaigns targeting Mitel MiVoice Connect deployments. Organizations should prioritize immediate patching.
What products are affected by CVE-2022-40765?
CVE-2022-40765 affects Mitel MiVoice Connect through version 19.3 (build 22.22.6100.0). The vulnerability specifically resides in the Edge Gateway component of the platform. All versions up to and including 19.3 are vulnerable.
How do I fix CVE-2022-40765?
Apply the security update described in Mitel Product Security Advisory 22-0007 and upgrade MiVoice Connect beyond version 19.3. Additionally, restrict adjacent network access to the Edge Gateway component and implement URL parameter filtering at the WAF level. See the Remediation section for complete guidance.
How severe is CVE-2022-40765?
CVE-2022-40765 is rated Medium with a CVSS score of 6.8, reflecting the requirement for adjacent network access and high privileges. However, its confirmed use in ransomware attacks and CISA KEV listing significantly increase its real-world risk. Successful exploitation results in full system compromise with high impact on confidentiality, integrity, and availability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.