CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability
Vulnerability summary
CVE-2022-26143 is a critical (CVSS 9.8) vulnerability in Mitel MiCollab, MiVoice Business Express. It is known to be exploited: CISA lists it, first on 25-03-2022. EPSS estimates a 87.33% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.
Listed as exploited by CISA (25-03-2022)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Duplicates 1Timeline
- 09-03-2022PublishedVulnerability first disclosed.
- 25-03-2022Added to CISA KEVExploitedMiCollab, MiVoice Business Express Access Control Vulnerability
- 15-04-2022CISA remediation dueDeadline passedApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
87.33%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 87.33% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 25-03-2022
- Federal due date
- 15-04-2022
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2022-26143
Public exploits
1 foundExploit Reference (arstechnica.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Mitel2 products
- micollab< 9.4 | 9.4 | 9.4:sp1
- mivoice_business_express≤ 8.1
1 vendor · 2 products
References
8 links- www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001X Refsource MISCVendor Advisory
- www.akamai.com/blog/security/phone-home-ddos-attack-vectorX Refsource MISCMitigationThird Party Advisory
- www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/X Refsource MISCMitigationThird Party Advisory
- team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/X Refsource MISCBroken LinkMitigationThird Party Advisory
- arstechnica.com/information-technology/…X Refsource MISCExploitPress/Media CoverageThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26143Government ResourceUS Government Resource