阿里云漏洞库

CVE编号

CVE-2022-26143

利用情况

暂无

补丁情况

官方补丁

披露时间

2022-03-11

Mitel Networks MiCollab是一款为员工提供语音、视频、消息、音频会议和团队协作的移动应用程序。Mitel Networks MiVoice Business Express是一套实时通信解决方案。

Mitel MiCollab 9.4 SP1 FP1之前版本和MiVoice Business Express R8.1及之前版本的TP-240 (aka tp240dvr)模块存在访问控制错误漏洞，攻击者可利用该漏洞获取敏感信息并导致拒绝服务。

Mitel已经为此发布了一个安全公告（22-0001）以及相应补丁:

链接：https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0001

参考链接
https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method...
https://blog.cloudflare.com/cve-2022-26143/
https://news.ycombinator.com/item?id=30614073
https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discove...
https://www.akamai.com/blog/security/phone-home-ddos-attack-vector
https://www.mitel.com/en-ca/support/security-advisories/mitel-product-securit...
https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-am...