Mitel MiCollab and MiVoice Business Express Remote Information Disclosure and DDoS Amplification Vulnerability (CVE-2022-26143)
Executive & SecOps Summary
SECOPS ASSESSMENTMitel MiCollab versions prior to 9.4 SP1 FP1 and MiVoice Business Express through version 8.1.
Unauthenticated remote attackers can access sensitive system information or abuse the system to launch high-volume DDoS amplification attacks (TP240PhoneHome) globally.
Apply official vendor security patches immediately and restrict external access to the TP-240 driver port (UDP 10074) via firewalls.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade the Mitel system to the latest secure release following the vendor's official advisory.
# Perform Mitel MiCollab platform update (requires administrative privileges)
# Note: Ensure a full system backup is taken before applying updates in production.
sudo yum update -y mitel-micollab-platform2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, block all inbound external traffic targeting the vulnerable UDP port.
# Block inbound UDP traffic on port 10074 using iptables
sudo iptables -A INPUT -p udp --dport 10074 -j DROP
# Save the firewall rules and restart the service
sudo service iptables save
sudo systemctl restart iptables3. Log Audit & IoC Verification Commands
Verify if the TP-240 driver is active and listening on the network.
# Check if the TP-240 process is running and listening on UDP port 10074
netstat -anup | grep 10074
ps -ef | grep tp240Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the TP-240 (tp240dvr) driver component integrated into Mitel MiCollab and MiVoice Business Express systems due to missing authentication for critical functions (CWE-306). The component exposes UDP port 10074 to the public internet without verifying the identity of incoming requests, allowing unauthenticated remote actors to execute commands and retrieve sensitive diagnostic data.
2. Exploitation Mechanics & Attack Scenario
Attackers exploit the stateless nature of UDP by spoofing the source IP address to match that of their intended victim. When a specially crafted request is sent to the vulnerable Mitel device on UDP port 10074, the TP-240 component responds with an extremely large volume of debug and system status information. This behavior yields an unprecedented traffic amplification factor (known as the TP240PhoneHome attack), turning the compromised Mitel system into a reflector for devastating DDoS attacks.
3. Infrastructure & Business Impact
This vulnerability has been actively exploited in the wild to conduct record-breaking DDoS attacks (listed in CISA KEV). If an organization's VoIP and collaboration infrastructure is weaponized as a DDoS reflector, it can lead to severe network bandwidth exhaustion, service outages, IP reputation damage, and potential exposure of internal system details.
Official Vendor Advisories & References
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.
Frequently Asked SecOps Questions (CVE-2022-26143)
FAQQ1. How critical is CVE-2022-26143 and is it actively exploited in the wild?
CVE-2022-26143 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 87.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-26143?
Primary impacted vendors include mitel across micollab, mivoice_business_express. Scope summary: Mitel MiCollab versions prior to 9.4 SP1 FP1 and MiVoice Business Express through version 8.1 with active TP-240 components.
Q3. What temporary mitigations or workarounds exist for CVE-2022-26143 before patching?
[Mitigation] Apply official vendor security patches immediately and restrict external access to the TP-240 driver port (UDP 10074) via firewalls. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-26143
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (mitel)
View Category →TrueConf Server Unauthenticated Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2026-72529)
[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier
MikroTik RouterOS Authentication Bypass, Kernel Panic, and Info Leak (CVE-2026-67277) Security Advisory
[Affected Scope] MikroTik RouterOS versions 6.x and 7.x prior to specific patched releases.
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.