CVE-2022-40765

What is Mitel MiVoice Connect?

Mitel MiVoice Connect (formerly ShoreTel) is an enterprise unified communications platform providing voice, messaging, and collaboration for business telephony. The platform includes multiple components: the Director (management), the Edge Gateway (network-facing VoIP gateway), and Connect clients. Because MiVoice Connect systems are often network-accessible for remote workers and VoIP routing, vulnerabilities in edge-facing components can provide initial network access in ransomware attack chains. See also CVE-2022-41223 for the related code injection vulnerability in the Director component.

Overview

CVE-2022-40765 is a command injection vulnerability (CWE-77) in the Mitel MiVoice Connect Edge Gateway component. An authenticated attacker with internal network access and admin-level credentials can inject OS commands that execute within the system context of the Edge Gateway. CISA added both CVE-2022-40765 and CVE-2022-41223 to KEV on the same day following confirmed ransomware exploitation.

Affected Versions

Technical Details

The Edge Gateway component in MiVoice Connect does not properly sanitize user-supplied input before passing it to underlying OS command execution (CWE-77). An authenticated administrator can submit crafted requests to the Edge Gateway management interface that include command injection sequences.

• Attack vector: Adjacent — attacker must be on the internal network or have access to the MiVoice management interface
• Authentication required: High — admin-level credentials
• Impact: Arbitrary command execution on the Edge Gateway appliance as a system-level user
• Ransomware use: Threat actors obtained MiVoice credentials (via phishing, credential stuffing, or other means) then used this and CVE-2022-41223 to establish persistence and lateral movement capabilities before deploying ransomware

Discovery

Reported to Mitel and disclosed via coordinated advisory.

Exploitation Context

CISA's February 2023 KEV addition reflects confirmed ransomware exploitation. MiVoice Connect devices are attractive targets because they are often network-accessible with less scrutiny than core IT infrastructure, yet they may hold credentials and provide network access that facilitates lateral movement into broader enterprise environments.

Remediation

1. Upgrade MiVoice Connect to version 19.3 SP3 or later
2. Restrict access to the MiVoice Connect management interface to trusted internal IPs and VPN-connected administrators only
3. Rotate all MiVoice Connect administrative credentials
4. Review access logs for unauthorized administrator logins and unusual command activity