{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2022-40765",
  "revision": 1,
  "title": "Mitel MiVoice Connect — Edge Gateway Command Injection",
  "summary": "The Edge Gateway component of Mitel MiVoice Connect through 19.3 does not restrict link parameters, so an authenticated attacker with internal network access can run commands on the system. Ransomware campaigns are known to use this flaw.",
  "source_type": "cve",
  "severity": "high",
  "cvss": {
    "score": 6.8,
    "vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "epss": 0.10566,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": false,
    "attack_complexity": "low",
    "kev_added": "2023-02-21",
    "kev_due": "2023-03-14",
    "prerequisites": "An authenticated account with internal network access to the Edge Gateway component."
  },
  "mitre_attack": [
    "T1059"
  ],
  "kill_chain": "execution",
  "recommended_action": "Follow Mitel security advisory 22-0007 and keep MiVoice Connect reachable only from trusted internal networks.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2022-40765",
      "retrieved_at": "2026-11-05T08:18:20.755Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-05T08:18:20.755Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2022-40765",
      "retrieved_at": "2026-11-05T08:18:20.755Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2022-40765",
      "retrieved_at": "2026-11-05T08:18:20.755Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40765",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://www.mitel.com/support/security-advisories"
    },
    {
      "type": "vendor_advisory",
      "url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007"
    }
  ],
  "published_at": "2022-11-22T01:15:31.847Z",
  "issued_at": "2026-11-05T08:18:20.755Z",
  "tags": [
    "mitel",
    "mivoice-connect",
    "command-injection",
    "ransomware"
  ]
}