CVE-2024-41713

Description

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.

Scoring

• CVSS: 9.1 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-01-07
• Remediation due date: 2025-01-28
• Known ransomware campaign use: Known

Weakness types (CWE)

• CWE-22
• CWE-22

References

• https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41713

More from Mitel

• CVE-2024-41710 — SIP Phones
• CVE-2024-55550 — MiCollab
• CVE-2022-41223 — MiVoice Connect
• CVE-2022-40765 — MiVoice Connect
• CVE-2022-29499 — MiVoice Connect