CVE-2022-40765
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
Prioritize patching. It under exploitation confirmed by CISA.
ssvc Attendcvss 6.8epss 11%
from disclosure to weapon
Published on NVDNov 22
CISA KEV+91d
Action required by CISAfederal deadline: 2023-03-14
Apply updates per vendor instructions.
In short
An authenticated attacker with internal network access can inject malicious commands into Mitel MiVoice Connect through URL parameters that aren't properly restricted, potentially compromising the system.
Technical detail
CWE-77 command injection vulnerability in Edge Gateway component allows authenticated internal users to execute arbitrary commands via insufficiently validated URL parameters. Requires valid credentials and network access to the affected system (versions through 19.3/22.22.6100.0).
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a