CVE-2022-26143: Mitel MiCollab DoS Vulnerability

CVE-2022-26143 Overview

CVE-2022-26143 is a critical vulnerability in the TP-240 (tp240dvr) component of Mitel MiCollab and MiVoice Business Express systems. This flaw allows remote attackers to obtain sensitive information and cause a denial of service through excessive outbound traffic generation. The vulnerability was actively exploited in the wild during February and March 2022 in what became known as the "TP240PhoneHome" DDoS amplification attack, capable of achieving unprecedented amplification ratios of up to 4.3 billion to 1.

Critical Impact

This vulnerability enables attackers to weaponize vulnerable Mitel systems as DDoS amplification reflectors, generating massive volumes of attack traffic from a single malicious request. CISA has added this to the Known Exploited Vulnerabilities catalog.

Affected Products

• Mitel MiCollab before 9.4 SP1 FP1
• Mitel MiVoice Business Express through 8.1
• Systems with exposed TP-240 (tp240dvr) component on UDP port 10074

Discovery Timeline

• 2022-03-08 - CVE-2022-26143 publicly disclosed with coordinated advisories from security researchers
• 2022-03-10 - CVE-2022-26143 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2022-26143

Vulnerability Analysis

The vulnerability resides in the TP-240 VoIP driver component (tp240dvr) which listens on UDP port 10074. This component is designed to facilitate system performance testing but lacks proper authentication mechanisms (CWE-306: Missing Authentication for Critical Function). When exposed to the internet, attackers can send specially crafted UDP packets that trigger the system to generate disproportionately large responses to spoofed source addresses, creating an amplification attack vector.

The exploitation mechanics are particularly severe because the component was designed to generate test traffic without considering the security implications of internet exposure. A single small UDP packet can trigger the system to send thousands of response packets, with researchers documenting amplification factors reaching 4.3 billion to 1 in certain configurations.

Root Cause

The root cause is the absence of authentication on the TP-240 driver's UDP interface combined with its traffic generation capabilities. The tp240dvr service accepts commands on UDP port 10074 without validating the source or requiring any form of authentication, allowing any remote attacker to instruct the system to generate substantial outbound traffic. This design flaw, coupled with UDP's connectionless nature allowing IP address spoofing, creates the conditions for a highly effective DDoS amplification attack.

Attack Vector

The attack leverages the UDP-based TP-240 protocol which inherently lacks source verification. Attackers send small spoofed UDP packets to vulnerable Mitel systems with the victim's IP address as the source. The Mitel system then floods the victim with amplified traffic, potentially generating gigabytes of attack data from a few bytes of input.

The exploitation flow involves:

1. Attacker identifies exposed Mitel systems with TP-240 on UDP port 10074
2. Attacker crafts UDP packets with specific tp240dvr commands
3. Packets are sent with spoofed source IP (victim's address)
4. Vulnerable Mitel system responds with amplified traffic to the victim
5. Multiple vulnerable systems can be coordinated for massive DDoS attacks

For detailed technical analysis of the exploitation methodology, see the Akamai DDoS Attack Insight and Cloudflare CVE Analysis.

Detection Methods for CVE-2022-26143

Indicators of Compromise

• Unusual outbound UDP traffic volume from Mitel systems, particularly on port 10074
• Unexpected network connections to the tp240dvr service from external IP addresses
• High CPU and network utilization on MiCollab or MiVoice Business Express systems
• Complaints from third parties about attack traffic originating from your network

Detection Strategies

• Monitor UDP port 10074 for inbound connections from external networks
• Implement network flow analysis to detect anomalous outbound traffic patterns from VoIP infrastructure
• Deploy intrusion detection signatures for TP-240 protocol abuse patterns
• Review firewall logs for blocked attempts to access UDP port 10074 from internet sources

Monitoring Recommendations

• Establish baseline traffic patterns for Mitel systems and alert on significant deviations
• Configure SNMP or syslog monitoring on Mitel devices to capture unusual activity
• Implement network-level DDoS detection at egress points to identify if systems are being used in amplification attacks
• Regularly audit internet-facing services to ensure TP-240 is not exposed

How to Mitigate CVE-2022-26143

Immediate Actions Required

• Block UDP port 10074 at the network perimeter to prevent external access to the TP-240 service
• Verify Mitel systems are not directly exposed to the internet
• Apply vendor patches immediately for MiCollab (upgrade to 9.4 SP1 FP1 or later) and MiVoice Business Express
• Audit network architecture to ensure VoIP infrastructure is properly segmented

Patch Information

Mitel has released security updates addressing this vulnerability. Organizations should upgrade to MiCollab version 9.4 SP1 FP1 or later. For MiVoice Business Express systems, consult the Mitel Security Advisory 22-0001 for specific remediation guidance. Given the active exploitation status and CISA KEV listing, patching should be prioritized as an emergency change.

Workarounds

• Implement firewall rules to block all external access to UDP port 10074
• Place Mitel systems behind a VPN or on isolated network segments without direct internet exposure
• If the tp240dvr service is not required for operations, disable it through system configuration
• Deploy network-based rate limiting for UDP traffic from Mitel systems as an additional layer of protection

# Example firewall rule to block external TP-240 access (iptables)
iptables -A INPUT -p udp --dport 10074 -s ! 10.0.0.0/8 -j DROP
iptables -A INPUT -p udp --dport 10074 -s ! 172.16.0.0/12 -j DROP
iptables -A INPUT -p udp --dport 10074 -s ! 192.168.0.0/16 -j DROP