Command Injection Vulnerability in Mitel MiVoice Connect
CVE-2022-40765

6.8MEDIUM

Key Information:

Vendor

Mitel
Status
Mivoice Connect
Vendor
CVE Published:
22 November 2022

Badges

💰 Ransomware👾 Exploit Exists🦅 CISA Reported

What is CVE-2022-40765?

A vulnerability exists in the Edge Gateway component of Mitel MiVoice Connect version 19.3, which allows authenticated attackers with internal network access to perform command injection attacks. This occurs due to inadequate restrictions on URL parameters, potentially leading to unauthorized command execution.

CISA has reported CVE-2022-40765

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2022-40765 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply updates per vendor instructions.

References

https://www.mitel.com/support/security-advisories
https://www.mitel.com/support/security-advisories/mitel-p...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.