CVE-2024-41713
A path‑traversal flaw in Mitel MiCollab’s NuPoint Unified Messaging component (up to version 9.8 SP1 FP2) lets an attacker read, change, or delete data without logging in. The bug is triggered by unsanitized input that can reach files outside the intended directory.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Mitel MiCollab, versions up to 9.8 SP1 FP2 (9.8.1.201).
Real-world impact
An unauthenticated attacker could view, corrupt, or delete users’ data and system configurations, potentially compromising the entire messaging system.
Why this severity
The CVSS score of 9.1 reflects a network‑based attack that requires no privileges or user interaction, yet grants full confidentiality and integrity compromise.
What to do about it
- ›Apply vendor‑provided mitigations as per Mitel’s instructions.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
CISA KEV required action
Timeline
- Oct 21, 2024 · Oct 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Jan 7, 2025 · Jan 7, 2025Confirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Jan 28, 2025 · Jan 28, 2025CISA remediation deadlineFederal agencies are required to remediate by this date.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- mitel.com/support/security-advisories…vendor advisory
- cisa.gov/known-exploited-vulnerabili…us government resource