CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability
CVE-2022-26143 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-03-25
The TP-240 (tp240dvr) component in Mitel MiCollab and MiVoice Business Express contains an access control vulnerability due to missing authentication. Remote attackers can exploit this to obtain sensitive information or trigger a denial of service via excessive outbound traffic, which has been used in 'TP240PhoneHome' reflection/amplification DDoS attacks.
Yes. CVE-2022-26143 is known to be exploited in the wild, first recorded on 25 March 2022. Treat it as urgent.
How severe is CVE-2022-26143?
Critical severity, with a CVSS score of 9.8, published 25 March 2022.
Which products and versions are affected?
Mitel MiCollab before 9.4 SP1 FP1; Mitel MiVoice Business Express through 8.1.
Is there a fix for CVE-2022-26143?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-26143 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2022-26143?
Check whether you run Mitel MiCollab or Mitel MiVoice Business Express. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Mitel MiCollab before 9.4 SP1 FP1
Mitel MiVoice Business Express through 8.1
Timeline
2022-02: exploited: Exploitation first observed in the wild.
2022-03-08: disclosed: Public disclosure of the TP240PhoneHome DDoS attack vector.
2022-03-25: advisory: Mitel advisory and CISA KEV addition.
2022-03-25: kev added: Added to CISA Known Exploited Vulnerabilities catalog.