The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to
Only MiCollab and MiVoice Business Express systems with the system test facility exposed to the public Internet are affected, per the checked facts. No vendor rating is given, and no fix is listed.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Mitel MiCollab and MiVoice Business Express are affected. Remote attackers could exploit the TP-240 component to obtain sensitive information and degrade system performance through excessive outbound network traffic.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 7
news.ycombinator.com
blog.cloudflare.com
Questions about CVE-2022-26143
What does this mean?
The TP-240 (tp240dvr) component in Mitel products can be abused when the system test facility is reachable from the public Internet. An attacker could reach sensitive information and services, degrade performance or cause a denial of service, or use the system to send large amounts of outbound traffic in DDoS reflection or amplification attacks.Source: shadowserver.org, mitel.com
Am I affected, and how do I check?
Affected are Mitel MiCollab versions prior to and including R9.4SP1 and MiVoice Business Express versions prior to and including R8.1, but only where the system test facility is exposed to the public Internet. To check, look at the installed MiCollab or MiVoice Business Express version and confirm whether the system test facility can be reached from outside the network.Source: shadowserver.org, mitel.com
What should I do about it?
The checked facts do not list a fixed release, so no upgrade target can be given. Check Mitel's advisory for the current fix status.Source: shadowserver.org, mitel.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-25, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
Keep the system test facility from being reachable from the public Internet, for example by blocking it at the firewall or removing public exposure. This limits the exposure described in the advisory while no fix is available.Source: shadowserver.org, mitel.com