CVE-2022-26143

What it actually does

CVE-2022-26143 is an unauthenticated network-accessible access-control flaw in the Mitel TP-240/tp240dvr component used by affected MiCollab and MiVoice Business Express deployments. A remote attacker can interact with the exposed service without valid credentials to extract sensitive information and trigger abnormal TP-240 behavior that generates excessive outbound traffic, resulting in service degradation or denial of service. The flaw has a critical CVSS score of 9.8, high EPSS probability, and is listed in CISA KEV, reflecting confirmed exploitation in the wild.

Why it matters to the business

Successful exploitation can turn affected communications infrastructure into a participant in large-scale DDoS activity, consume bandwidth, degrade voice/collaboration services, expose sensitive system information, and create reputational or legal risk if the organization’s infrastructure is observed attacking third parties. Because this vulnerability is in CISA KEV with a historical remediation deadline of 2022-04-15 and has been actively exploited, any internet-exposed affected system should be treated as urgent even though the issue is older.

How an attack unfolds

An attacker scans the internet for exposed Mitel TP-240/tp240dvr services associated with vulnerable MiCollab or MiVoice Business Express systems. After identifying a reachable service, the attacker sends unauthenticated crafted network traffic to the TP-240 component. The vulnerable component accepts the traffic without proper access control and can disclose sensitive information or generate excessive outbound traffic toward attacker-selected destinations. In the observed TP240PhoneHome activity from February and March 2022, this behavior was abused as part of distributed denial-of-service attacks, where compromised or exposed systems were used to amplify traffic against third-party victims rather than requiring the attacker to compromise the host fully.

How to fix it

Upgrade affected Mitel deployments to fixed releases: MiCollab 9.4 SP1 FP1 or later, and vendor-supported fixed releases for MiVoice Business Express beyond the affected 8.1 line. Restrict TP-240/tp240dvr and related voice/collaboration services from direct internet exposure using firewalls, VPNs, ACLs, and segmentation. Block unnecessary inbound and outbound traffic for the TP-240 service, especially unsolicited internet-originated traffic and unexpected outbound high-volume flows. Review vendor hardening guidance for MiCollab and MiVoice Business Express. The provided package metadata also lists Debian trafficserver fixes: Debian 11 fixed in 8.1.5+ds-1~deb11u1 and Debian 12 fixed in 9.1.3+ds-1; validate asset-to-CVE applicability before using those package versions as the sole remediation signal because the vulnerability description concerns Mitel TP-240.

How to confirm the fix worked

Confirm the installed Mitel MiCollab or MiVoice Business Express version is at or above the vendor-fixed release and that TP-240/tp240dvr is not exposed to untrusted networks. Validate externally with authorized scanning that no TP-240 service is reachable from the internet except where explicitly required and protected. Review firewall and flow telemetry to ensure the system is not producing unexpected outbound traffic spikes. For package-based inventories that report Debian trafficserver exposure, confirm Debian 11 systems are running 8.1.5+ds-1~deb11u1 or later and Debian 12 systems are running 9.1.3+ds-1 or later, while separately verifying whether the asset actually contains the affected Mitel component.

Typical attack path

1. Identify internet-exposed Mitel MiCollab or MiVoice Business Express systems running vulnerable TP-240/tp240dvr components.
2. Probe the exposed TP-240 service to confirm it responds without authentication.
3. Send crafted unauthenticated requests that exercise the access-control flaw.
4. Cause the system to disclose sensitive information or generate high-volume outbound traffic.
5. Use the affected system as part of a reflection/amplification DDoS campaign or degrade the availability of local communications services.
6. Repeat across many exposed systems to increase attack scale and impact.

How to detect it

Review network flow, firewall, IDS/IPS, load balancer, and perimeter logs for unsolicited inbound traffic to TP-240/tp240dvr services and unusual outbound traffic bursts from affected Mitel systems. Look for high-volume outbound UDP or other network traffic from communications servers to unfamiliar external destinations, especially patterns consistent with reflection or amplification DDoS behavior. Examine system and application logs for TP-240/tp240dvr errors, repeated unauthenticated requests, service instability, resource exhaustion, or unexpected restarts. Correlate traffic spikes with degraded voice/collaboration service performance. Because exploitation may primarily manifest as network abuse rather than persistent malware, absence of files or processes does not rule out exploitation; prioritize flow telemetry and perimeter device logs. If threat-intelligence or DDoS provider logs reference TP240PhoneHome activity, correlate those timestamps with affected system network telemetry.

• tp240dvr
• TP-240
• TP240PhoneHome
• UDP/10074
• 10074/udp
• MiCollab
• MiVoice Business Express
• excessive outbound traffic
• performance degradation

What your security team should do

• Immediately inventory all Mitel MiCollab and MiVoice Business Express deployments and identify any internet-exposed TP-240/tp240dvr services.
• Prioritize remediation for exposed systems because the vulnerability is CISA KEV-listed, has active in-the-wild exploitation, and has a high EPSS score.
• Upgrade affected Mitel systems to MiCollab 9.4 SP1 FP1 or later and applicable fixed MiVoice Business Express releases.
• Apply network controls to restrict TP-240 access to trusted management or voice network ranges only.
• Hunt for historical signs of TP240PhoneHome-style DDoS abuse, especially outbound traffic spikes from affected systems during and after February 2022.
• Monitor for unusual UDP-heavy outbound traffic, repeated unauthenticated probes, and external scanning against TP-240-associated ports.
• Validate any Debian trafficserver package findings against actual installed software and upgrade to the listed fixed package versions where applicable.