CVE-2024-41713
Mitel MiCollab Path Traversal Vulnerability
Description
CVE-2024-41713 is a critical path traversal vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab, a widely deployed unified communications platform. The flaw affects Mitel MiCollab through version 9.8 SP1 FP2 (9.8.1.201) and allows an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. With a CVSS v3.1 base score of 9.1, successful exploitation enables unauthorized access that can result in viewing, corrupting, or deleting users' data and system configurations. CISA has added CVE-2024-41713 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 28, 2025, and it carries a Known ransomware association. The EPSS score of 93.91% at the 99.9th percentile confirms near-certain exploitation across the threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mitel | micollab | <= 9.8.1.201 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
Weakness Type
Path Traversal in NuPoint Unified Messaging Component
CVE-2024-41713 is a path traversal vulnerability caused by insufficient input validation in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab. The application fails to properly sanitize user-supplied input used in file path construction, allowing an attacker to use directory traversal sequences to access files and directories outside the intended scope. Unlike typical path traversal vulnerabilities that are limited to read access, this flaw enables an unauthenticated attacker to view, corrupt, and delete users' data and system configurations, making it both a confidentiality and integrity threat. Path traversal vulnerabilities in unified communications platforms are particularly dangerous because these systems often store sensitive voicemail recordings, user credentials, and configuration data. Learn more about CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
The impact of CVE-2024-41713 is severe across both confidentiality and integrity dimensions. Confidentiality is fully compromised (C:H) because the path traversal vulnerability allows an unauthenticated attacker to access files and data that should be restricted. This includes user data, voicemail recordings, system configurations, and potentially credential stores within the MiCollab environment. In enterprise unified communications deployments, this data often includes sensitive business communications, authentication details, and internal network configuration information.
Integrity faces maximum impact (I:H) because successful exploitation can result not only in viewing but also corrupting or deleting users' data and system configurations. An attacker can modify configuration files to create backdoor access, alter user settings, or tamper with voicemail and messaging data. The ability to delete data adds a destructive dimension that can disrupt business operations.
The attack profile is highly favorable for attackers: it requires no authentication (PR:N), no user interaction (UI:N), is accessible over the network (AV:N), and has low attack complexity (AC:L). The confirmed ransomware association elevates the practical risk significantly, as threat actors are actively using this vulnerability as an initial access vector in ransomware campaigns targeting MiCollab deployments. When chained with CVE-2024-55550 (a local file read vulnerability in MiCollab), attackers can achieve comprehensive reconnaissance and data exfiltration capabilities. The EPSS score of 93.91% at the 99.9th percentile confirms this vulnerability is among the most heavily exploited in the current threat landscape.
Exploit Maturity
CVE-2024-41713 has reached maximum exploit maturity with confirmed active exploitation, a direct ransomware association, and inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of January 28, 2025. The EPSS score of 93.91% at the 99.9th percentile places it among the most actively exploited vulnerabilities tracked globally.
The Known ransomware classification by CISA confirms that this vulnerability is being used as an initial access vector in ransomware attack chains. In practice, CVE-2024-41713 is commonly chained with CVE-2024-55550, another MiCollab vulnerability, to create a more comprehensive attack. The unauthenticated path traversal from CVE-2024-41713 provides the initial foothold, while CVE-2024-55550 extends file system access capabilities. Mitel has published a detailed security advisory addressing this vulnerability at MISA-2024-0029. The combination of no authentication requirement, network accessibility, and confirmed ransomware use makes this vulnerability an extremely high-priority remediation target.
Remediation
-
Update Mitel MiCollab to the latest patched version immediately. Apply the security update referenced in Mitel's security advisory MISA-2024-0029. The vulnerability affects MiCollab through version 9.8 SP1 FP2 (9.8.1.201), and organizations must upgrade beyond this version to a release that addresses the path traversal flaw.
-
Patch CVE-2024-55550 simultaneously. CVE-2024-41713 is commonly chained with CVE-2024-55550, a local file read vulnerability in the same MiCollab product. Both vulnerabilities must be patched together to eliminate the full attack chain. Addressing only one leaves the system partially vulnerable to the combined exploit sequence.
-
Restrict network access to MiCollab servers. As an immediate mitigation measure, block direct internet access to the MiCollab NuPoint Unified Messaging component. Deploy MiCollab behind a web application firewall (WAF) configured to detect and block path traversal attempts. Limit access to MiCollab administrative and voicemail interfaces to trusted internal network segments only.
-
Assume compromise and investigate. Given the confirmed ransomware association and near-maximum EPSS score, any organization running MiCollab 9.8 SP1 FP2 or earlier with internet-facing components should assume potential compromise. Conduct a thorough forensic investigation including reviewing web server access logs for path traversal patterns, checking for unauthorized file access or modification, scanning for ransomware indicators, and verifying the integrity of all MiCollab configuration files.
-
Implement monitoring and detection controls. Deploy intrusion detection rules that flag path traversal patterns in requests to MiCollab endpoints. Monitor for unusual file access on MiCollab servers, unexpected data exfiltration, and any indicators associated with ransomware staging activities such as lateral movement attempts and credential harvesting.
Technical Details
CVE-2024-41713 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, resulting in a critical base score of 9.1. The vector indicates a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). The scope is unchanged (S:U), with high impact to both confidentiality (C:H) and integrity (I:H), but no availability impact (A:N).
The vulnerability resides in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab, which handles voicemail and unified messaging functionality. The NPM component exposes web-accessible endpoints that accept file path parameters as part of their normal operation. The insufficient input validation allows an attacker to inject directory traversal sequences (such as "../" patterns) into these parameters, escaping the intended directory boundary and accessing arbitrary files and directories on the MiCollab server.
The attack mechanism is straightforward: an unauthenticated attacker sends crafted HTTP requests to the NuPoint Unified Messaging endpoints containing path traversal sequences. Because the application does not properly canonicalize or validate these path inputs, the traversal sequences are processed by the underlying filesystem operations, allowing the attacker to navigate the directory tree. The high confidentiality and integrity impacts reflect the fact that the attacker can not only read but also corrupt or delete files, including user data and system configuration files. The absence of availability impact (A:N) in the CVSS vector suggests the vulnerability does not directly cause service disruption, though the ability to delete configuration files could indirectly affect availability. Affected versions include Mitel MiCollab through 9.8 SP1 FP2 (version 9.8.1.201 and earlier).
Frequently Asked Questions
What is CVE-2024-41713?
CVE-2024-41713 is a critical path traversal vulnerability in the NuPoint Unified Messaging component of Mitel MiCollab that allows an unauthenticated attacker to access, modify, and delete users' data and system configurations. It has a CVSS v3.1 score of 9.1 and is actively exploited in ransomware campaigns.
Is CVE-2024-41713 associated with ransomware?
Yes. CISA has classified CVE-2024-41713 as having a Known ransomware association. Threat actors are actively using this vulnerability as an initial access vector in ransomware attack chains targeting Mitel MiCollab deployments. This makes immediate patching critical for all affected organizations.
How does CVE-2024-41713 relate to CVE-2024-55550?
Both vulnerabilities affect Mitel MiCollab and are frequently chained together in attacks. CVE-2024-41713 provides unauthenticated initial access through path traversal in the NuPoint Unified Messaging component, while CVE-2024-55550 extends the attacker's ability to read local files. Patching both vulnerabilities simultaneously is essential to break the complete attack chain.
Does CVE-2024-41713 require authentication to exploit?
No. CVE-2024-41713 can be exploited by an unauthenticated attacker with network access to the MiCollab NuPoint Unified Messaging component. This is one of the most dangerous aspects of the vulnerability, as it eliminates any credential-based barrier to exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.