Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 87.2%; technical severity is CVSS 9.8.
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.
Who should care
- Teams operating MiCollab, MiCollab, MiVoice Business Express, Mivoice Business Express
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether MiCollab, MiCollab, MiVoice Business Express, Mivoice Business Express is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Apply updates per vendor instructions.
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Vendor remediation
Patch and remediation links
Use the vendor source below to confirm the correct fixed version, package or mitigation for your affected product.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-306
- Affected versions
- Mitel MiCollab (Version: 9.4); Mitel MiCollab, MiVoice Business Express; Mitel Mivoice Business Express (End Including: 8.1)
- Published
- 10 March 2022
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 87.2%
- Signal calculated at 84
External references
- Government advisory from www.cisa.gov
- Exploit information from arstechnica.com
- Mitigation guidance from blog.cloudflare.com
- Third-party advisory from news.ycombinator.com
- Mitigation guidance from team-cymru.com
- Mitigation guidance from www.akamai.com
- Vendor advisory from www.mitel.com
- Mitigation guidance from www.shadowserver.org