Risk Letters

Exploited vulnerability

CVE-2024-55550

TLP:CLEAR

Mitel MiCollab Path Traversal Vulnerability

Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.

Facts

  • Vendor: Mitel
  • Product: MiCollab
  • CVSS: 2.7
  • EPSS (probability of exploitation within 30 days): 38.2 %
  • On CISA's Known Exploited Vulnerabilities list since: 7 January 2025
  • First known exploitation: 7 January 2025
  • Used in ransomware campaigns (per CISA): Yes
  • CISA's deadline for US federal agencies: 28 January 2025
  • Weakness: CWE-22
  • First seen by Risk Letters: 7 January 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD