{"id":"CVE-2022-26143","kind":"vulnerability","aliases":["CVE-2022-26143"],"related":[],"title":"Mitel MiCollab, MiVoice Business Express: MiCollab, MiVoice Business Express Access Control Vulnerability","description":"The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.","summary":"Mitel MiCollab and MiVoice Business Express have an access control flaw that lets an attacker reach sensitive information and services without authorization, and can also degrade performance or cause denial of service. CISA lists it in the Known Exploited Vulnerabilities catalog, so attacks are happening in the wild.","severity":"critical","cvss":9.8,"epss":0.87325,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Mitel MiCollab, MiVoice Business Express","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","micollab","mitel","mivoice-business-express","self-hosted","voip"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the updates per the vendor instructions (CISA required action); the specific fixed version is not stated in the sources.","status":"open","published_at":"2022-03-10T17:47:32+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:55+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:21:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per the vendor instructions (CISA required action); the specific fixed version is not stated in the sources.","reach":"unknown","impact":"high","summary":"Mitel MiCollab and MiVoice Business Express have an access control flaw that lets an attacker reach sensitive information and services without authorization, and can also degrade performance or cause denial of service. CISA lists it in the Known Exploited Vulnerabilities catalog, so attacks are happening in the wild.","category":"infrastructure","who_cares":["mitel","micollab","mivoice-business-express","voip","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads sensitive data and uses services without authorization, or crashes the system","analyst_note":"Find the Mitel advisory and the affected/fixed version list, plus the exposure check, from the vendor security advisory for CVE-2022-26143 (not in the provided sources).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000489,"input_tokens":2878,"output_tokens":402,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':14A,17A '-240':86C '-26143':15A,18A '2022':132C '8.1':102C '9.4':94C 'access':10A,44B 'aka':87C 'allow':103C 'also':60B 'attack':50B,78B,105C,137C 'author':57B 'busi':4A,8A,30B,40B,99C 'business':22A 'catalog':76B 'caus':64B,111C 'cisa':68B 'compon':89C 'control':11A,45B 'cve':13A,16A 'ddos':136C 'degrad':61B,117C 'denial':65B,113C 'excess':119C 'exploit':24B,74B,124C 'express':5A,9A,23A,31B,41B,100C 'februari':129C 'flaw':46B 'fp1':96C 'happen':80B 'host':34B 'inform':53B,109C 'infrastructur':25B 'known':73B 'let':48B 'list':69B 'march':131C 'micollab':2A,6A,20A,26B,37B,92C 'mitel':1A,19A,27B,36B,91C 'mivoic':3A,7A,29B,39B,98C 'mivoice':21A 'mivoice-business-express':28B 'obtain':107C 'outbound':120C 'perform':62B,116C 'reach':51B 'remot':104C 'self':33B 'self-host':32B 'sensit':52B,108C 'servic':55B,67B,115C 'sp1':95C 'tp':85C 'tp240dvr':88C 'tp240phonehome':135C 'traffic':121C 'voip':35B 'vulner':12A,75B 'wild':83B,127C 'without':56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-10T17:47:32+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-26143","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26143","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:40+00:00","note":null},{"source":"epss","external_id":"CVE-2022-26143","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26143","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-26143","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26143","severity":null,"published_at":"2022-03-10T17:47:32+00:00","modified_at":"2026-06-17T04:34:46+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}