CriticalCVE-2022-26143

    MiCollab, MiVoice Business Express Access Control Vulnerability (CVE-2022-26143)

    Published In CISA KEV since Sources: CVE.org

    What is affected, what to do

    The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

    The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Conflicting version data — version display is hidden until the data is resolved.

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: CVE.org

    87.3 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.75

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    229.13 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    87.3 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.75
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 29 January 2025
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-306

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This flaw is reachable over the network without authentication or user interaction. It was weaponised in the TP240PhoneHome DDoS campaigns with an exceptionally large amplification factor, and it sits among the CVEs most likely to be exploited. Affected organisations are those running internet-exposed Mitel UC systems; targets of the reflected floods included ISPs, financial institutions and logistics firms. For your organisation this creates two risks: liability and reputational damage as an attack platform, and loss of telephony. CISA does not flag known ransomware use. If UDP/10074 is internet-exposed, treat the finding as critical and act now; internal-only systems should still be patched with high priority in the regular cycle.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Check exposure: Inventory every MiCollab and MiVoice Business Express system and confirm whether the TP-240 test service (tp240dvr, publicly documented on UDP/10074) is reachable from the internet. An external scan of your own public ranges for UDP/10074 answers this in minutes.
      • Block at the perimeter: Drop inbound UDP/10074 from the internet at the perimeter firewall or edge ACLs immediately. The service is not needed from the internet for normal telephony operation.
      • Patch: Upgrade MiCollab to 9.4 SP1 FP1 or later. For MiVoice Business Express (affected through 8.1), a patch is available from the vendor — look up the fixed version in the vendor advisory.
      • Rule out reflector abuse: Review NetFlow and firewall logs from recent weeks for abnormal outbound UDP volume with source port 10074. If you find it, isolate or throttle the host and notify your upstream ISP.
      • Assess reporting duties: If your system served as a DDoS reflector or degraded through resource exhaustion, assess NIS2/national CSIRT reporting obligations. A telephony outage may qualify as a significant incident for critical-infrastructure operators.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: Move UC/telephony servers into a dedicated voice VLAN or DMZ with no direct internet reachability. Publish only the services you actually need, such as SIP/TLS, teleworker gateways and the web portal, via a reverse proxy or session border controller.
      • Egress filtering: Deny outbound UDP with source port 10074 from UC hosts to the internet. Add per-host outbound UDP rate limits on the edge router so a vulnerable box cannot act as an amplifier.
      • IPS signature: Deploy a Suricata/Snort rule on UDP/10074 matching the test service's control commands, e.g. content:"call.startblast" or content:"call.help". Set the rule to drop when running inline.
      • Anti-spoofing: Enforce BCP38/uRPF at your network edges. This does not prevent exploitation itself, but it reduces your overall exposure to reflection abuse originating from your own network.
      • Configuration hardening: Disable unneeded test and diagnostic services on MiCollab/MBX per vendor guidance. Restrict management access to a dedicated admin jump network.

    3. Runbook step 3

      Detection rules

      • Zeek conn.log: Flag inbound UDP/10074 from external sources, e.g. id.resp_p == 10074 && proto == "udp" && !local_orig. Treat any internet-sourced hit as at least reconnaissance.
      • NetFlow/IPFIX anomaly: Flag outbound UDP from UC servers with src_port=10074 and a high response-to-request byte ratio. The attack produces an extreme amplification factor and long-lived outbound floods. SPL example: index=netflow src_port=10074 | stats sum(bytes) by src_ip, dest_ip | where 'sum(bytes)'>100000000
      • Suricata payload match: Alert on call.startblast, call.help or other call.* control strings in UDP payloads to port 10074. call.help indicates probing and information disclosure; call.startblast indicates active reflection.
      • Performance telemetry: Treat CPU spikes, packet loss, dropped calls or WAN link saturation on the UC server as secondary indicators. Correlate them with firewall logs on port 10074.
      • External signals: Feed ISP abuse reports, national CERT notifications and Shadowserver reports on exposed Mitel/TP240 services into your SOC intake.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

    Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    mitelmicollab
    • 9.4
    • < 9.4
    • —
    • 9.4
    mitelmivoice_business_express
    • ≤ 8.1
    • —

    Vendors and products

    Weakness classes (CWE)

    • CWE-306Missing Authentication for Critical Function

      Base

      The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

      Entry at MITRE CWE-306

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited

    References & sources

    • mitel.comen-ca/support/security-advisories/mitel-product-security-adviso…x_refsource_MISC, Vendor advisory
    • akamai.comblog/security/phone-home-ddos-attack-vectorx_refsource_MISC, Mitigation, Third-party advisory
    • shadowserver.orgnews/cve-2022-26143-tp240phonehome-reflection-amplification-ddo…x_refsource_MISC, Mitigation, Third-party advisory
    • news.ycombinator.comitem?id=30614073x_refsource_MISC, Issue tracking, Third-party advisory
    • blog.cloudflare.comcve-2022-26143x_refsource_MISC, Mitigation, Third-party advisory
    • team-cymru.comblog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2…x_refsource_MISC, Broken link, Mitigation, Third-party advisory
    • arstechnica.cominformation-technology/2022/03/ddosers-use-new-method-capable-o…x_refsource_MISC, Exploit, Press coverage, Third-party advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26143government-resource, US government resource
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2022-26143
    <a href="https://intel.neosec.eu/en/cve/CVE-2022-26143"><img src="https://intel.neosec.eu/badge/cve/CVE-2022-26143.svg?lang=en" alt="CVE-2022-26143 – NEOSEC Intel" height="20"></a>