erroneo.us
Search all guides⌘K

Security Digest · Oct 9, 2024 · Vulnerability · Other

Mitel MiCollab CVE-2024-41713: Exploited Auth Bypass

Unauthenticated path traversal in Mitel MiCollab, chained with file-read bug CVE-2024-55550 and exploited. Fixed in 9.8 SP2. Confirm, then check logs.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Check exposure

Mitel fixed this in October 2024 and CISA confirmed exploitation in January 2025. Make sure every MiCollab server runs 9.8 SP2 or later, then look for signs of access during the window when it was exposed and unpatched.

Who must act: Organizations running Mitel MiCollab 9.8 SP1 FP2 (9.8.1.201) or earlier, especially where the MiCollab web interface is reachable from the internet for remote users.

Who can relax: MiCollab customers who reached 9.8 SP2 (9.8.2.12) or later before the public exploit in December 2024 and never exposed older builds, and anyone who does not run MiCollab.

Affected
Mitel MiCollab 9.8 SP1 FP2 (9.8.1.201) and earlier (CVE-2024-41713)
Mitel MiCollab through 9.8 SP2 (CVE-2024-55550; Mitel says SP2 substantially mitigates it)
Fixed in
Mitel MiCollab 9.8 SP2 (9.8.2.12) or later
Mitel interim patch for MiCollab 6.0 and later (Mitel KB000116041), for customers who cannot upgrade promptly
CVSS
9.8 (v3.1, vendor)
EPSS
97.2% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. List every MiCollab server and note its software version in the administration interface; 9.8.1.201 or lower is vulnerable.
  2. Upgrade to MiCollab 9.8 SP2 (9.8.2.12) or a later release. Use Mitel's interim patch (KB000116041) only if an upgrade is not possible.
  3. Keep MiCollab administrative and NuPoint web paths off the internet. Publish only the user-facing services remote staff need, through a VPN or filtering reverse proxy where you can.
  4. Search web, proxy and WAF logs back to October 2024 for '..;/' requests under /npm-pwg/ and for ReconcileWizard requests.
  5. If an unpatched server was internet-facing, rotate MiCollab administrator and user credentials and review it for configuration changes you did not make.

How to check if you are affected or compromised

  • Search web server, reverse proxy or WAF logs for '..;/' in request paths, especially '/npm-pwg/..;/'.
  • Look for POST requests to /npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall, and for '../' inside the reportName field wherever request bodies are logged.
  • Review MiCollab for admin actions, new accounts or provisioning changes since late 2024 that nobody can explain.

What happened#

On October 9, 2024, Mitel published MISA-2024-0029 for CVE-2024-41713. The bug is a path traversal in the NuPoint Unified Messaging (NPM) component of MiCollab, Mitel's unified communications server. Mitel rates it CVSS 3.1 9.8; NVD scores it 9.1. Without logging in, an attacker can reach provisioning data and perform administrative actions on the server.

Sonny Macdonald of watchTowr reported the bug. watchTowr's write-up explains that a ..;/ sequence after /npm-pwg/ lets requests reach other Tomcat applications, such as npm-admin, without authentication. watchTowr also reported a separate post-login file read in the ReconcileWizard reportName field. More than 100 days passed with no fix. On December 5, 2024, watchTowr published a proof of concept that chains the two bugs to read /etc/passwd without credentials. Mitel then assigned CVE-2024-55550 to the file read and rated it low (2.7), saying it exposes only non-sensitive system information.

CISA added both CVEs to the KEV catalog on January 7, 2025. It flags both as known to be used in ransomware campaigns.

Who is affected#

CVE-2024-41713 affects MiCollab 9.8 SP1 FP2 (9.8.1.201) and earlier, and 9.8 SP2 (9.8.2.12) fixes it. For customers who cannot upgrade promptly, Mitel offers a patch for releases 6.0 and later. For CVE-2024-55550, Mitel says 9.8 SP2 "substantially" mitigates it and promised a full fix in a future update. As of Oct 23, 2026, we found no later Mitel statement confirming a complete fix. In December 2024, watchTowr counted more than 16,000 MiCollab instances on the internet.

Do you really need to act?#

On 9.8 SP2 or later, this is mostly verification. The risk sits in three places:

  • Servers still below 9.8 SP2: a public exploit has existed since December 2024 and the request is trivial to send. Upgrade now and assume the server has been probed.
  • Servers that were exposed and unpatched after December 5, 2024: hunt for past access, even if they are patched now.
  • Internal-only servers: lower risk, but an intruder already inside can use the same bug.

Neither CISA nor Mitel has said who exploited these flaws. SecurityWeek found no public details of the attacks. CISA's ransomware flag is the only signal of who uses it.

What to do now#

  1. Inventory every MiCollab server and read its version in the administration interface. Anything at 9.8.1.201 or lower is vulnerable.
  2. Upgrade to 9.8 SP2 (9.8.2.12) or later. Use the Mitel patch in KB000116041 only as a stopgap.
  3. Keep admin and NuPoint web paths off the internet, and expose only the client services remote users need.
  4. Search logs back to October 2024, for example grep -F '..;/' access.log* on your reverse proxy, and look for any hits under /npm-pwg/.
  5. If an exposed server ran a vulnerable build, rotate administrator and user passwords and review provisioning and configuration changes.

How to tell if you were hit#

Mitel and CISA have published no indicators of compromise. The New Zealand NCSC alert covers only upgrading. Use the request patterns from watchTowr's research. Legitimate clients do not send ..;/ in URLs, so treat any request containing /npm-pwg/..;/ as hostile. That includes /npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall, the file-read endpoint. If your proxy logs request bodies, look for ../ sequences in reportName. A hit that returned HTTP 200 on a vulnerable build means data may have been read. Preserve the logs, rotate credentials and contact Mitel support.

Timeline#

  • — watchTowr reports the authentication bypass (and a SQL injection) to Mitel.
  • — watchTowr reports the post-authentication file read.
  • — Mitel publishes MISA-2024-0029, and MiCollab 9.8 SP2 (9.8.2.12) fixes CVE-2024-41713.
  • — watchTowr publishes details and a proof of concept chaining both bugs.
  • — Mitel updates the advisory with CVE-2024-55550, and on Dec 12 expands patch compatibility.
  • — CISA adds both CVEs to KEV, with a federal due date of January 28, 2025.
  • — New Zealand's NCSC warns of active exploitation.

Vulnerability records

  • CVE-2024-41713 · KEV 2025-01-07 · A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to…
  • CVE-2024-55550 · KEV 2025-01-07 · Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Mitel — Product Security Advisory MISA-2024-0029: MiCollab Path Traversal Vulnerability mitel.com
  2. CVE record — CVE-2024-41713 cve.org
  3. CVE record — CVE-2024-55550 cve.org
  4. NVD — CVE-2024-41713 nvd.nist.gov
  5. NVD — CVE-2024-55550 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2024-41713 cisa.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2024-55550 cisa.gov
  8. watchTowr Labs — Where There's Smoke, There's Fire: Mitel MiCollab CVE-2024-35286, CVE-2024-41713 and an 0day labs.watchtowr.com
  9. NCSC New Zealand — Active exploitation affecting Mitel MiCollab ncsc.govt.nz

Coverage and analysis

  1. SecurityWeek — CISA warns of Mitel MiCollab vulnerabilities exploited in attacks securityweek.com