Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-26143

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

Published

2022-03-10T17:47:32.813

Last Modified

2025-11-03T15:15:14.620

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

8.5

Weaknesses

Type: Primary
CWE-306
Type: Secondary
CWE-306

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mitel	micollab	< 9.4	Yes
Application	mitel	micollab	9.4	Yes
Application	mitel	micollab	9.4	Yes
Application	mitel	mivoice_business_express	≤ 8.1	Yes

References

https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/ Exploit, Press/Media Coverage, Third Party Advisory ([email protected])
https://blog.cloudflare.com/cve-2022-26143/ Mitigation, Third Party Advisory ([email protected])
https://news.ycombinator.com/item?id=30614073 Issue Tracking, Third Party Advisory ([email protected])
https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/ Broken Link, Mitigation, Third Party Advisory ([email protected])
https://www.akamai.com/blog/security/phone-home-ddos-attack-vector Mitigation, Third Party Advisory ([email protected])
https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001 Vendor Advisory ([email protected])
https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/ Mitigation, Third Party Advisory ([email protected])
https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/ Exploit, Press/Media Coverage, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://blog.cloudflare.com/cve-2022-26143/ Mitigation, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://news.ycombinator.com/item?id=30614073 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/ Broken Link, Mitigation, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.akamai.com/blog/security/phone-home-ddos-attack-vector Mitigation, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/ Mitigation, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26143 US Government Resource (134c704f-9b21-4f2e-91b3-4a467353bcc0)