---
title: "Mitel MiCollab CVE-2024-41713: Exploited Auth Bypass"
url: https://erroneo.us/security/briefs/mitel-micollab-cve-2024-41713-path-traversal/
description: "Unauthenticated path traversal in Mitel MiCollab, chained with file-read bug CVE-2024-55550 and exploited. Fixed in 9.8 SP2. Confirm, then check logs."
type: security-brief
section: "Security Digest"
date_published: 2024-10-09
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-41713", "CVE-2024-55550"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Mitel MiCollab CVE-2024-41713: Exploited Auth Bypass

**Verdict: Check exposure.** Mitel fixed this in October 2024 and CISA confirmed exploitation in January 2025. Make sure every MiCollab server runs 9.8 SP2 or later, then look for signs of access during the window when it was exposed and unpatched.

- **Who must act:** Organizations running Mitel MiCollab 9.8 SP1 FP2 (9.8.1.201) or earlier, especially where the MiCollab web interface is reachable from the internet for remote users.
- **Who can relax:** MiCollab customers who reached 9.8 SP2 (9.8.2.12) or later before the public exploit in December 2024 and never exposed older builds, and anyone who does not run MiCollab.
- **Affected:** Mitel MiCollab 9.8 SP1 FP2 (9.8.1.201) and earlier (CVE-2024-41713); Mitel MiCollab through 9.8 SP2 (CVE-2024-55550; Mitel says SP2 substantially mitigates it)
- **Fixed:** Mitel MiCollab 9.8 SP2 (9.8.2.12) or later; Mitel interim patch for MiCollab 6.0 and later (Mitel KB000116041), for customers who cannot upgrade promptly
- **CVEs:** CVE-2024-41713, CVE-2024-55550
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every MiCollab server and note its software version in the administration interface; 9.8.1.201 or lower is vulnerable.
2. Upgrade to MiCollab 9.8 SP2 (9.8.2.12) or a later release. Use Mitel's interim patch (KB000116041) only if an upgrade is not possible.
3. Keep MiCollab administrative and NuPoint web paths off the internet. Publish only the user-facing services remote staff need, through a VPN or filtering reverse proxy where you can.
4. Search web, proxy and WAF logs back to October 2024 for '..;/' requests under /npm-pwg/ and for ReconcileWizard requests.
5. If an unpatched server was internet-facing, rotate MiCollab administrator and user credentials and review it for configuration changes you did not make.

### How to check if you are affected

- Search web server, reverse proxy or WAF logs for '..;/' in request paths, especially '/npm-pwg/..;/'.
- Look for POST requests to /npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall, and for '../' inside the reportName field wherever request bodies are logged.
- Review MiCollab for admin actions, new accounts or provisioning changes since late 2024 that nobody can explain.

## What happened

On October 9, 2024, Mitel published [MISA-2024-0029](https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029) for CVE-2024-41713. The bug is a path traversal in the NuPoint Unified Messaging (NPM) component of MiCollab, Mitel's unified communications server. Mitel rates it CVSS 3.1 9.8; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-41713) scores it 9.1. Without logging in, an attacker can reach provisioning data and perform administrative actions on the server.

Sonny Macdonald of watchTowr reported the bug. [watchTowr's write-up](https://labs.watchtowr.com/where-theres-smoke-theres-fire-mitel-micollab-cve-2024-35286-cve-2024-41713-and-an-0day/) explains that a `..;/` sequence after `/npm-pwg/` lets requests reach other Tomcat applications, such as `npm-admin`, without authentication. watchTowr also reported a separate post-login file read in the ReconcileWizard `reportName` field. More than 100 days passed with no fix. On December 5, 2024, watchTowr published a proof of concept that chains the two bugs to read `/etc/passwd` without credentials. Mitel then assigned CVE-2024-55550 to the file read and rated it low (2.7), saying it exposes only non-sensitive system information.

CISA added both CVEs to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41713) on January 7, 2025. It flags both as known to be used in ransomware campaigns.

## Who is affected

CVE-2024-41713 affects MiCollab 9.8 SP1 FP2 (9.8.1.201) and earlier, and 9.8 SP2 (9.8.2.12) fixes it. For customers who cannot upgrade promptly, Mitel offers a patch for releases 6.0 and later. For [CVE-2024-55550](https://nvd.nist.gov/vuln/detail/CVE-2024-55550), Mitel says 9.8 SP2 "substantially" mitigates it and promised a full fix in a future update. As of Oct 23, 2026, we found no later Mitel statement confirming a complete fix. In December 2024, watchTowr counted more than 16,000 MiCollab instances on the internet.

## Do you really need to act?

On 9.8 SP2 or later, this is mostly verification. The risk sits in three places:

- **Servers still below 9.8 SP2:** a public exploit has existed since December 2024 and the request is trivial to send. Upgrade now and assume the server has been probed.
- **Servers that were exposed and unpatched after December 5, 2024:** hunt for past access, even if they are patched now.
- **Internal-only servers:** lower risk, but an intruder already inside can use the same bug.

Neither CISA nor Mitel has said who exploited these flaws. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-mitel-micollab-vulnerabilities-exploited-in-attacks/) found no public details of the attacks. CISA's ransomware flag is the only signal of who uses it.

## What to do now

1. Inventory every MiCollab server and read its version in the administration interface. Anything at 9.8.1.201 or lower is vulnerable.
2. Upgrade to 9.8 SP2 (9.8.2.12) or later. Use the Mitel patch in KB000116041 only as a stopgap.
3. Keep admin and NuPoint web paths off the internet, and expose only the client services remote users need.
4. Search logs back to October 2024, for example `grep -F '..;/' access.log*` on your reverse proxy, and look for any hits under `/npm-pwg/`.
5. If an exposed server ran a vulnerable build, rotate administrator and user passwords and review provisioning and configuration changes.

## How to tell if you were hit

Mitel and CISA have published no indicators of compromise. The [New Zealand NCSC alert](https://www.ncsc.govt.nz/alerts/active-exploitation-affecting-mitel-micollab-2/) covers only upgrading. Use the request patterns from watchTowr's research. Legitimate clients do not send `..;/` in URLs, so treat any request containing `/npm-pwg/..;/` as hostile. That includes `/npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall`, the file-read endpoint. If your proxy logs request bodies, look for `../` sequences in `reportName`. A hit that returned HTTP 200 on a vulnerable build means data may have been read. Preserve the logs, rotate credentials and contact Mitel support.

## Timeline

- May 29, 2024 — watchTowr reports the authentication bypass (and a SQL injection) to Mitel.
- Aug 26, 2024 — watchTowr reports the post-authentication file read.
- Oct 9, 2024 — Mitel publishes MISA-2024-0029, and MiCollab 9.8 SP2 (9.8.2.12) fixes CVE-2024-41713.
- Dec 5, 2024 — watchTowr publishes details and a proof of concept chaining both bugs.
- Dec 9, 2024 — Mitel updates the advisory with CVE-2024-55550, and on Dec 12 expands patch compatibility.
- Jan 7, 2025 — CISA adds both CVEs to KEV, with a federal due date of January 28, 2025.
- Jan 8, 2025 — New Zealand's NCSC warns of active exploitation.

## Sources

1. [Mitel — Product Security Advisory MISA-2024-0029: MiCollab Path Traversal Vulnerability](https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029)
2. [CVE record — CVE-2024-41713](https://www.cve.org/CVERecord?id=CVE-2024-41713)
3. [CVE record — CVE-2024-55550](https://www.cve.org/CVERecord?id=CVE-2024-55550)
4. [NVD — CVE-2024-41713](https://nvd.nist.gov/vuln/detail/CVE-2024-41713)
5. [NVD — CVE-2024-55550](https://nvd.nist.gov/vuln/detail/CVE-2024-55550)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-41713](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41713)
7. [CISA — Known Exploited Vulnerabilities: CVE-2024-55550](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55550)
8. [watchTowr Labs — Where There's Smoke, There's Fire: Mitel MiCollab CVE-2024-35286, CVE-2024-41713 and an 0day](https://labs.watchtowr.com/where-theres-smoke-theres-fire-mitel-micollab-cve-2024-35286-cve-2024-41713-and-an-0day/)
9. [NCSC New Zealand — Active exploitation affecting Mitel MiCollab](https://www.ncsc.govt.nz/alerts/active-exploitation-affecting-mitel-micollab-2/)
10. [SecurityWeek — CISA warns of Mitel MiCollab vulnerabilities exploited in attacks](https://www.securityweek.com/cisa-warns-of-mitel-micollab-vulnerabilities-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/mitel-micollab-cve-2024-41713-path-traversal/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt