⚠ Actively exploited

Added to CISA KEV on 2022-03-25. Federal agencies required to patch by 2022-04-15. Required action: Apply updates per vendor instructions..

CVE-2022-26143 — Missing Authentication for Critical Function in Micollab

CWE-306 — Missing Authentication for Critical Function CWE-863 — Incorrect Authorization CWE-406 — Insufficient Control of Network Message Volume (Network Amplification)6 documents6 sources

Severity

9.8CRITICALNVD

EPSS

89.1%

top 0.46%

CISA KEV

KEV

Added 2022-03-25

Due 2022-04-15

Exploit

Exploited in wild

Active exploitation observed

Affected products

Mitel Micollab Mitel Mivoice Business Express

Timeline

PublishedMar 10

KEV addedMar 25

KEV dueApr 15

CISA Required Action: Apply updates per vendor instructions.

Description

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDmitel/mivoice_business_express8.1

▶NVDmitel/micollab< 9.4+1

🔴Vulnerability Details

GHSA

GHSA-xh7f-2c8g-37p4: The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9↗2022-03-11

▶

CVEList

CVE-2022-26143: The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9↗2022-03-09

▶

VulnCheck

MiCollab, MiVoice Business Express Access Control Vulnerability↗2022

▶

💥Exploits & PoCs

Nuclei

Mitel MiCollab - Information Disclosure & Denial of Service

▶

📋Vendor Advisories

CISA

MiCollab, MiVoice Business Express Access Control Vulnerability↗2022-03-25

▶