{"id":"CVE-2022-26143","aliases":["EUVD-2022-30710","GHSA-xh7f-2c8g-37p4"],"status":"published","title":"The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business...","description":"The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.87325,"percentile":0.99757,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-306","CWE-406","CWE-863"],"published":"2022-03-09T15:32:54Z","modified":"2026-06-17T04:34:46Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"exploits":[{"source":"nuclei","id":"CVE-2022-26143","title":"Mitel MiCollab - Information Disclosure \u0026 Denial of Service","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26143.yaml"}],"products":[{"vendor":"mitel","product":"micollab"},{"vendor":"mitel","product":"micollab, mivoice business express"},{"vendor":"mitel","product":"mivoice_business_express"}],"references":[{"url":"https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.akamai.com/blog/security/phone-home-ddos-attack-vector","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory"]},{"url":"https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory"]},{"url":"https://news.ycombinator.com/item?id=30614073","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://blog.cloudflare.com/cve-2022-26143/","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory"]},{"url":"https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/","tags":["x_refsource_MISC","x_transferred","Broken Link","Mitigation","Third Party Advisory"]},{"url":"https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/","tags":["x_refsource_MISC","x_transferred","Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26143","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26143"},{"url":"https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion"},{"url":"https://blog.cloudflare.com/cve-2022-26143"},{"url":"https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143"},{"url":"https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector"},{"url":"https://github.com/advisories/GHSA-xh7f-2c8g-37p4"}],"sources":{"cve":[{"id":"CVE-2022-26143","description":"The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.","status":"published","published":"2022-03-09T15:32:54Z","modified":"2025-10-21T23:15:44.508Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-30710","description":"The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.","status":"published","published":"2022-03-09T15:32:54Z","modified":"2025-10-21T23:15:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-xh7f-2c8g-37p4","title":"The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business...","description":"The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.","status":"published","published":"2022-03-11T00:02:03Z","modified":"2025-10-22T00:32:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306","CWE-863"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2022-26143","title":"MiCollab, MiVoice Business Express Access Control Vulnerability","description":"A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.","cwes":["CWE-306","CWE-406"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2022-26143","description":"The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.","status":"published","published":"2022-03-10T17:47:32.813Z","modified":"2026-06-17T04:34:46.337Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:07:13.7085Z"}]}}