QwikSec

Security Database

CVE

CWE

Training

CVE-2022-26143

Published: Mar 9, 2022

Modified: Oct 21, 2025

PUBLISHED

Description

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001

x_refsource_MISC

https://www.akamai.com/blog/security/phone-home-ddos-attack-vector

x_refsource_MISC

https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/

x_refsource_MISC

https://news.ycombinator.com/item?id=30614073

x_refsource_MISC

https://blog.cloudflare.com/cve-2022-26143/

x_refsource_MISC

https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/

x_refsource_MISC

https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.