CVE-2022-40765

What it actually does

The flaw is an authenticated command-injection vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions through 19.3 (22.22.6100.0). Because URL parameters are not sufficiently constrained before being processed by the gateway, an attacker with internal network access and valid high-privilege authentication can inject operating-system command syntax into a vulnerable request. Successful exploitation can execute arbitrary commands in the security context of the Edge Gateway process, potentially allowing full compromise of the appliance, access to sensitive communications infrastructure data, configuration tampering, service disruption, and pivoting within the voice network.

Why it matters to the business

Compromise of a Mitel MiVoice Connect Edge Gateway can disrupt voice communications, expose sensitive call-routing or system configuration data, and provide attackers a foothold inside the network. This vulnerability is listed in CISA KEV, has confirmed in-the-wild exploitation, and is associated with ransomware activity, so unpatched exposed deployments should be treated as high priority even though exploitation requires authenticated internal access. The CISA remediation deadline was 2023-03-14, meaning affected systems are materially overdue for remediation in regulated or government-aligned environments.

How an attack unfolds

An attacker first obtains internal network access to the environment where the Mitel MiVoice Connect Edge Gateway is reachable, then authenticates with an account that has sufficient privileges to access the vulnerable functionality. The attacker sends a crafted HTTP request to the Edge Gateway containing shell metacharacters or command payloads inside vulnerable URL parameters. Because the appliance does not adequately restrict or sanitize those parameters, the injected content is interpreted as an operating-system command. The attacker can then run reconnaissance commands, write files, stage tooling, alter gateway configuration, create persistence where possible, disrupt services, or use the gateway as a pivot point toward other voice or internal network systems. Given KEV and ransomware linkage, post-exploitation activity should be investigated for credential access, lateral movement, and ransomware staging.

How to fix it

Upgrade Mitel MiVoice Connect to a vendor-supported release that contains the fix for the Edge Gateway command-injection issue. Mitel lists affected versions as MiVoice Connect through 19.3 (22.22.6100.0); if a fixed build is not available in local patch catalogs, obtain the current corrected release or hotfix directly from Mitel support. Because this vulnerability is in CISA KEV and associated with ransomware activity, prioritize remediation of all reachable Edge Gateway instances. Until patched, restrict administrative and Edge Gateway access to dedicated management networks or VPNs, enforce least-privilege accounts, rotate potentially exposed administrative credentials, disable unnecessary access paths, apply network ACLs to limit internal reachability, and monitor for suspicious authenticated requests containing shell metacharacters or encoded command syntax.

How to confirm the fix worked

Confirm the deployed Mitel MiVoice Connect and Edge Gateway build is later than the affected range, specifically not through 19.3 (22.22.6100.0), and verify the vendor advisory or support portal identifies the installed build as fixed. Enumerate all Edge Gateway instances, including standby, lab, remote-office, and disaster-recovery systems. Validate that only approved management networks can reach administrative interfaces. Review application and web access logs to confirm vulnerable URL parameters no longer accept command syntax and that attempted injection payloads are rejected. If safe internal validation is required, use an approved scanner or vendor-provided test procedure rather than manually sending destructive command payloads.

Typical attack path

1. Gain access to the internal network segment where the Mitel MiVoice Connect Edge Gateway is reachable.
2. Obtain or reuse valid privileged credentials for the MiVoice Connect Edge Gateway or related administrative interface.
3. Send a crafted authenticated HTTP request containing command-injection syntax in a URL parameter.
4. Execute operating-system commands through the vulnerable Edge Gateway process.
5. Perform reconnaissance such as user, network, process, and configuration discovery.
6. Stage additional tools or scripts, modify configuration, or establish persistence if permitted by the appliance environment.
7. Pivot to adjacent communications or internal systems, exfiltrate data, disrupt voice services, or support ransomware deployment.

How to detect it

Review Mitel MiVoice Connect Edge Gateway web access logs, application logs, appliance system logs, reverse-proxy logs, VPN logs, identity-provider logs, firewall logs, and EDR telemetry where available. Focus on authenticated requests to Edge Gateway administrative or service endpoints that contain shell metacharacters, URL-encoded command separators, command substitution syntax, or attempts to invoke common system utilities. Correlate suspicious requests with successful logins from unusual internal hosts, newly created sessions, unexpected administrative activity, configuration changes, service restarts, or outbound network connections from the gateway. On the appliance or supporting host telemetry, look for web or gateway service processes spawning shells or utilities such as sh, bash, curl, wget, nc, netcat, python, perl, chmod, chattr, iptables, whoami, id, uname, ps, or crontab. Because this vulnerability has KEV status and ransomware association, extend hunting to adjacent systems for lateral movement, credential access, remote execution, suspicious SMB/RDP/SSH activity, unusual archive creation, and ransomware staging artifacts after any suspected exploitation timestamp.

• %3B
• %26%26
• %7C%7C
• %60
• %24%28
• ;whoami
• ;id
• ;uname
• ;curl
• ;wget
• ;nc
• ;netcat
• ;bash
• ;sh
• && whoami
• && id
• && curl
• && wget
• | whoami
• | id
• `whoami`
• $(whoami)
• /bin/sh
• /bin/bash
• chmod +x
• crontab -e

What your security team should do

• Immediately identify all Mitel MiVoice Connect Edge Gateway deployments and determine whether any are running versions through 19.3 (22.22.6100.0).
• Patch or upgrade affected systems to a fixed vendor-supported release; treat this as urgent because it is in CISA KEV, has active exploitation, and is associated with ransomware campaigns.
• Restrict Edge Gateway and administrative interface access to trusted management networks only; block broad internal access where not required.
• Review privileged accounts for the platform, remove unnecessary access, enforce MFA where supported, and rotate credentials if exploitation is suspected or logs are incomplete.
• Search historical web, application, appliance, proxy, and firewall logs for authenticated requests with shell metacharacters or encoded command-injection patterns in URL parameters.
• Investigate any unexpected child processes, outbound connections, file writes, configuration changes, or service restarts on Edge Gateway systems.
• Hunt for post-exploitation behavior, including credential dumping attempts, lateral movement from the gateway, reconnaissance commands, and ransomware staging activity.
• Preserve forensic images and logs before rebuilding any suspected compromised appliance.