CVE-2022-40765

Timeline

Detection, updates, and resolution for this record.

1. Nov 21, 2022 · Catalog

   Detected

   A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

2. Feb 21, 2023 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Mar 14, 2023 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

Affected

• cpe mitel/mivoice connectversion unspecified
• vendor Mitel MiVoice Connectversion unspecified

Sources

• CISA KEVCVE-2022-40765

  The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.

  cisa.gov
• CVE.orgCVE-2022-40765

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2022-40765

  30-day exploitation probability 10.6%

  first.org
• NIST NVDCVE-2022-40765

  A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · mitel.com
• CISA note · mitel.com