CVE-2022-26143: mitel micollab +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-26143

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 87,3%

Kerentanan Missing Authentication for Critical Function pada mitel micollab, mitel mivoice business express. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

Rincian

Terbit di NVD: 10 Maret 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-306: Missing Authentication for Critical Function
EPSS (30 hari): 87,3% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: MiCollab, MiVoice Business Express Access Control Vulnerability
Masuk KEV: 25 Maret 2022
Tenggat CISA: 15 April 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mitel	micollab	Semua versi sebelum 9.4
mitel	micollab	Versi 9.4
mitel	micollab	Versi 9.4 sp1
mitel	mivoice business express	Semua versi hingga 8.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001 advisory vendor
https://blog.cloudflare.com/cve-2022-26143/ mitigasi · advisory pihak ketiga
https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/ broken link · mitigasi · advisory pihak ketiga
https://www.akamai.com/blog/security/phone-home-ddos-attack-vector mitigasi · advisory pihak ketiga
https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/ mitigasi · advisory pihak ketiga
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26143 pemerintah AS
https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by... exploit · press/media coverage · advisory pihak ketiga
https://news.ycombinator.com/item?id=30614073 issue tracking · advisory pihak ketiga

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.