Template / PR Information

• Added CVE-2022-26143 Mitel MiCollab TP-240 DDoS Amplification Vulnerability
• References:
  • https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/
  • https://nvd.nist.gov/vuln/detail/CVE-2022-26143
  • https://www.rapid7.com/blog/post/2022/03/10/mitel-tp240-phonehome-ddos-amplification-cve-2022-26143/
• Issue: Closes #12494

Template Validation

I’ve validated this template locally?

• YES (syntax and structure validated)
• NO

Additional Details (leave it blank if not applicable)

Shodan Query: port:10074

Template Details:

• Sends 4-byte UDP payload (00000000) to port 10074
• Detects amplification response using word matchers for “tp240” or “mitel”
• Based on public POC for TP240PhoneHome DDoS attack

Current Status:

• Template is syntactically correct and follows POC logic
• Need real device testing for debug output
• Have requested community help for validation (Discord post made)

Debug Output (Local Test): [INF] Using Nuclei Engine v2.9.15 [INF] Template loaded: network/cves/2022/CVE-2022-26143.yaml [WRN] Could not make network request for (127.0.0.1:10074): connection refused [INF] No results found. Better luck next time!

Request: Could the maintainers or community members help validate this template against a test environment and provide debug output? I’m happy to update the template based on any feedback.

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

/claim #12494