Vulnerability Lookup

🛡️ CVE-2022-26143

🔴 CVSS 9.8 — Critical ⚠️ Exploit Public CWE-306 NVD

9.8

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

Details

Severity CRITICAL

CVSS Score 9.8

CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE CWE-306

Public Exploit ⚠️ Yes

Source NVD

Published 2022-03-10

Updated 2026-06-08

Modified 2025-11-03

Fix URL N/A

Affected Packages

Software	From version	Fixed in
micollab	—	—
mivoice-business-express	—	8.1

References

Exploit, Press/Media Coverage, Third Party Advisory https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/

Mitigation, Third Party Advisory https://blog.cloudflare.com/cve-2022-26143/

Issue Tracking, Third Party Advisory https://news.ycombinator.com/item?id=30614073

Broken Link, Mitigation, Third Party Advisory https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/

Mitigation, Third Party Advisory https://www.akamai.com/blog/security/phone-home-ddos-attack-vector

Vendor Advisory https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001

Mitigation, Third Party Advisory https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/

Exploit, Press/Media Coverage, Third Party Advisory https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/

Mitigation, Third Party Advisory https://blog.cloudflare.com/cve-2022-26143/

Issue Tracking, Third Party Advisory https://news.ycombinator.com/item?id=30614073

Broken Link, Mitigation, Third Party Advisory https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/

Mitigation, Third Party Advisory https://www.akamai.com/blog/security/phone-home-ddos-attack-vector

Vendor Advisory https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001

Mitigation, Third Party Advisory https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/

US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26143

🔗 NVD 🔗 Mitre

Similar Threats

Patch Gap Protection

Running software with known vulnerabilities?

BotEraser can help reduce exposure by blocking IPs associated with exploit activity — even before a patch is available.

Start Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Running software with known vulnerabilities?

Company

Resources

Services

Trusted

Subscribe