Actively exploited in the wild
Mitel MiVoice Connect Command Injection Vulnerability
Mitel - MiVoice Connect · Listed in the CISA KEV since 2023-02-21. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-40765
MediumCVSS 6.8KEVSummary
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
Risk Assessment
An attacker with internal network access could execute arbitrary system commands on the Edge Gateway device, potentially leading to full compromise of the telecommunication system.
Recommendation
Update Mitel MiVoice Connect to the latest version containing fixes for URL parameter validation. Consider network segmentation and restricting access to the Edge Gateway interface.
Other vulnerabilities in Mitel MiVoice Connect
Original NVD description (English source)
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.