A Zero-Day in Mitel MiCollab Enables Record-Setting UDP Amplification
A newly disclosed zero-day vulnerability in the Mitel MiCollab business phone system, tracked as CVE-2022-26143, is being exploited to launch UDP amplification DDoS attacks. Dubbed TP240PhoneHome, the flaw allows attackers to magnify traffic by an enormous factor—up to 2.2 billion percent—by reflecting packets off vulnerable servers toward a target.
Cloudflare, alongside other members of the InfoSec community, has been investigating the exploit. Evidence suggests it has been active as early as February 18, 2022. Emergency mitigation rules have already been deployed to protect Cloudflare customers from these attacks.
Exposed Debugging Port Opens the Door
Mitel Networks provides collaboration products to over 70 million business users, with MiCollab deployed in critical infrastructure including municipal governments and emergency services. The vulnerability stems from an unauthenticated UDP port—port 10074—that is incorrectly exposed to the public Internet.
The call control protocol listening on this port offers a debugging command called startblast. While it doesn't place real telephone calls, it simulates a burst of calls for system testing. For every test call, the command emits two UDP packets back to the requester. Since the protocol is UDP-based and supports IP spoofing, an attacker can falsify the source address and redirect the flood of response traffic to any victim on the Internet.
Because the service requires no authentication, it can reflect and amplify traffic to cause massive distributed denial-of-service attacks. The vendor advisory notes that the exploit could allow "a malicious actor to gain unauthorized access to sensitive information and services," and cause denial-of-service conditions with significant outbound traffic.
Beyond amplification, the exposed port exposes other commands that could potentially be abused for toll fraud or rendering phone systems inoperable. These additional attack vectors remain unassessed due to lack of access to a safe testing environment.
Limited Exposure but Dangerous Amplification
A mitigating factor is that only a few thousand devices are improperly exposed to the Internet. The collective bandwidth is limited to several hundred million packets per second—enough to knock unprotected networks offline, but manageable for always-on DDoS mitigation services.
Another limitation is that the server processes commands serially rather than in parallel. When an attacker launches an attack with a large packet count, that device is effectively tied up for the duration and cannot be used to target anyone else until it completes.
Autonomous Mitigation at the Edge
To defend against these threats, Cloudflare operates software-defined DDoS protection systems that run autonomously. Incoming traffic is routed via BGP Anycast to the nearest edge data center, where packet samples are analyzed asynchronously—without adding latency.
The analysis uses data streaming algorithms to compare packet samples against known fingerprints, creating real-time signatures with dynamic attribute masking. When an attack signature matches an activation threshold, a mitigation rule is compiled and pushed inline to drop the malicious traffic.
Protection and Response
Mitel has issued a security advisory recommending that customers use firewalls to block exploitation attempts until a patch is released. Magic Transit customers can immediately block external traffic targeting the exposed UDP port by creating a Magic Firewall rule with the Block action and the following expression:
(udp.dstport eq 10074)
Cloudflare customers are already shielded by emergency rules deployed during the investigation. Since 2017, Cloudflare has offered unmetered and unlimited DDoS protection at no cost to all customers via their Free plan.
Users interested in the deeper technical analysis of the vulnerability can find more in the joint-disclosure technical blog post.
