CVE-2022-26143

nvd nist nuclei

Published: Mar 10, 2022Modified: Jun 17, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

Affected (4)

Products: Mitel: Micollab, Mivoice Business Express

2 products

Mivoice Business Express

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mitel Micollab	Before 9.4
Mitel Micollab	Version 9.4
Mitel Micollab	Version 9.4 sp1
Mitel Mivoice Business Express	Up to 8.1

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (15)

https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/

Source: cve@mitre.org

ExploitPress/Media CoverageThird Party Advisory

https://blog.cloudflare.com/cve-2022-26143/

Source: cve@mitre.org

MitigationThird Party Advisory

https://news.ycombinator.com/item?id=30614073

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/

Source: cve@mitre.org

Broken LinkMitigationThird Party Advisory

https://www.akamai.com/blog/security/phone-home-ddos-attack-vector

Source: cve@mitre.org

MitigationThird Party Advisory

https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001

Source: cve@mitre.org

Vendor Advisory

https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/

Source: cve@mitre.org

MitigationThird Party Advisory

https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPress/Media CoverageThird Party Advisory

https://blog.cloudflare.com/cve-2022-26143/

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party Advisory

https://news.ycombinator.com/item?id=30614073

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkMitigationThird Party Advisory

https://www.akamai.com/blog/security/phone-home-ddos-attack-vector

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party Advisory

https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26143

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.