Actively exploited in the wild
Mitel MiCollab Path Traversal Vulnerability
Mitel - MiCollab · Listed in the CISA KEV since 2025-01-07. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-41713
CriticalCVSS 9.1KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. Successful exploit could allow unauthorized access, enabling viewing, corrupting, or deleting users' data and system configurations.
Risk Assessment
An attacker can gain access to sensitive data, and also corrupt or delete it, impacting system integrity and availability.
Recommendation
Update Mitel MiCollab to a patched version. Restrict access to the NPM component and monitor logs.
Original NVD description (English source)
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.