CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability
First published: Wed Mar 09 2022(Updated: )
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mitel MiCollab | <9.4 | |
| Mitel MiCollab | =9.4 | |
| Mitel MiCollab | =9.4-sp1 | |
| Mitel Mivoice Business Express | <=8.1 | |
| Mitel MiCollab, MiVoice Business Express | ||
| <9.4 | ||
| =9.4 | ||
| =9.4-sp1 | ||
| <=8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/
- https://blog.cloudflare.com/cve-2022-26143/
- https://news.ycombinator.com/item?id=30614073
- https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/
- https://www.akamai.com/blog/security/phone-home-ddos-attack-vector
- https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001
- https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/
- https://nvd.nist.gov/vuln/detail/CVE-2022-26143
Frequently Asked Questions
What is the vulnerability ID for this MiCollab and MiVoice Business Express vulnerability?
The vulnerability ID for this MiCollab and MiVoice Business Express vulnerability is CVE-2022-26143.
What is the severity of CVE-2022-26143?
CVE-2022-26143 has a severity level of 9.8, which is considered critical.
What is the affected software for CVE-2022-26143?
The affected software for CVE-2022-26143 includes Mitel MiCollab versions up to 9.4 SP1 FP1 and MiVoice Business Express versions up to 8.1.
How can remote attackers exploit CVE-2022-26143?
Remote attackers can exploit CVE-2022-26143 to obtain sensitive information and cause a denial of service, resulting in performance degradation and excessive outbound traffic.
Are there any known public references for CVE-2022-26143?
Yes, there are public references available for CVE-2022-26143, including articles on Ars Technica, Cloudflare, and Hacker News.
- agent/type
- agent/title
- agent/severity
- agent/weakness
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- collector/nvd-cve
- source/NVD
- vendor/mitel
- canonical/mitel micollab
- version/mitel micollab/9.4
- version/mitel micollab/9.4-sp1
- canonical/mitel mivoice business express
- version/mitel mivoice business express/8.1
- canonical/mitel micollab, mivoice business express