PT-2022-25525 · Mitel · Mitel Mivoice Connect

Brian Pitchford + 1 · Published 2022-11-22 · Updated 2025-11-03 · CVE-2022-40765

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitel MiVoice Connect versions through 19.3 (22.22.6100.0)

Description A vulnerability in the Edge Gateway component could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

Recommendations For Mitel MiVoice Connect versions through 19.3 (22.22.6100.0), consider restricting access to the Edge Gateway component until a patch is available. As a temporary workaround, restrict the use of URL parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-40765

Affected Products

Mitel Mivoice Connect

References · 10

• https://mitel.com/support/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40765 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40765 · Vendor Advisory
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007 · Vendor Advisory, Security Note
• https://t.me/cveNotify/141384 · Telegram Post
• https://t.me/cibsecurity/53298 · Telegram Post
• https://t.me/cvenotify/109849 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40765 · Note
• https://t.me/echeloneyes/1221 · Telegram Post
• https://t.me/thehackernews/3079 · Telegram Post