Actively exploited · Published Oct 21, 2024 · Assigned by mitre
CVE-2024-41713
Critical 9.1 Exploited Ransomware
In plain English
A critical-severity path traversal in MiCollab from Mitel. Attackers are actively exploiting it in the wild (listed by CISA on January 7, 2025). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 97.2% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jan 28, 2025.
Official description
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N