CVE-2022-40765 is a command injection vulnerability in Mitel MiVoice Connect. CISA added it to the Known Exploited Vulnerabilities catalogue on 21 February 2023, which means attackers have used it in real attacks. The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
What command injection means in this product
Command injection in a communications platform is dangerous because it turns a software flaw into operating-system level execution. In Mitel MiVoice Connect, the vulnerable gateway component sits close to core call and network services, so a successful exploit can do far more than crash a single request path.
Because CISA added this CVE to the KEV catalogue, organisations should treat it as an actively exploited exposure rather than a theoretical weakness. The practical question is not only whether the product exists anywhere in the estate, but whether the vulnerable component is reachable from the networks it should not trust.
Why this vulnerability class is high impact
Command injection is especially severe when it appears in an edge-facing or communications-management component, because the attacker is no longer limited to the application’s intended functions. They can leverage the product’s own trust boundary to run commands in the context of the system and potentially pivot into adjacent services, configuration data, or management functions.
That kind of access can be used for service disruption, surveillance, tampering, or staging for broader compromise. In a communications environment, the impact often extends beyond one host because the system may mediate authentication, routing, or administrative control over a wider voice platform.
For background on the exploit class itself, see the Web Application Attacks Guide, which covers command injection patterns alongside related input-driven attack paths.
How organisations should assess exposure and containment
Exposure assessment starts with asset inventory, version identification, and a clear view of where the Mitel Edge Gateway is deployed. From there, organisations should determine whether the affected component is internet reachable, reachable only from internal subnets, or isolated behind additional controls, because exploitability changes with network path and trust placement.
Vendor advisories and the CISA KEV catalogue should be the authoritative sources for version and remediation status, while internal inventory tells you whether the product is actually present in a way that matters. If the service cannot be patched immediately, compensate with strict network restriction, segmentation, and administrative access limits so the vulnerable interface is not broadly exposed.
For prioritisation and validation, the Vulnerability Management Guide is useful because it ties asset scope, KEV prioritisation, verification, and remediation tracking together.
Detection, remediation, and compromise review
Remediation should focus on the vendor’s corrected software and any compensating controls needed until deployment is complete. Where exploitation is suspected, review the system for new processes, unexpected configuration changes, unusual outbound connections, modified web or service files, and administrative actions that do not match normal platform behaviour.
Post-patch review matters because command injection can leave behind persistence even after the vulnerable code is fixed. Organisations should check for changed service accounts, added users, altered startup tasks, scheduled jobs, or signs that the system was used as a foothold for lateral movement.
Because command injection is a common web-facing exploit pattern, a broader hunt should also consider whether the same network segment contains other exposed management interfaces with similar input-handling weaknesses. The CVE Program and NIST National Vulnerability Database remain the canonical places to confirm record details and track downstream references.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Command injection exposure depends on how the product is deployed and exposed. |
| CIS-7 — Continuous Vulnerability Management | This CVE is KEV-listed and needs prioritised discovery, validation, and remediation. | |
| Recommendation — Harden and segment the gateway so only required management paths remain reachable. Prioritise affected Mitel assets for verification, patching, and exception tracking. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The vulnerability requires asset discovery, exposure checks, and remediation verification. |
| SI-10 — Information Input Validation | Command injection is enabled by unsafe handling of external input. | |
| SC-7 — Boundary Protection | The exploit risk is shaped by how the edge gateway is segmented and exposed. | |
| Recommendation — Scan for the vulnerable component and verify remediation after change. Validate and constrain inputs that can reach command execution paths. Restrict network reachability to the gateway and isolate administrative paths. | ||