CVE-2024-55550
Mitel MiCollab Path Traversal Vulnerability
Description
CVE-2024-55550 is a local file read vulnerability in Mitel MiCollab, a unified communications and collaboration platform widely used in enterprise environments. Although rated as low severity with a CVSS v3.1 base score of 2.7, the vulnerability allows an authenticated attacker with administrative privileges to read local files on the MiCollab server due to insufficient input sanitization. Affected versions include Mitel MiCollab through 9.8 SP2 (9.8.1.201). Notably, CISA has added CVE-2024-55550 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 28, 2025, and it carries a Known ransomware association, elevating its practical risk far beyond what the low CVSS score suggests. The EPSS score stands at 14.91% at the 94.4th percentile, indicating significant exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mitel | micollab | <= 9.8.1.201 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- https://www.mitel.com/support/security-advisories(Vendor Advisory)
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55550(US Government Resource)
Weakness Type
Path Traversal via Insufficient Input Sanitization
CVE-2024-55550 is a local file inclusion vulnerability that arises from insufficient input sanitization in Mitel MiCollab's file handling mechanisms. When an authenticated administrator interacts with certain file-related functionality, the application fails to properly validate and sanitize file path inputs. This allows an attacker to use path traversal sequences to escape the intended directory and access files elsewhere on the server's filesystem. While the vulnerability is constrained to read-only access and limited to non-sensitive system information according to the vendor, its confirmed exploitation in the wild and ransomware association suggest that attackers have found ways to extract valuable intelligence from the exposed files. Learn more about CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
Despite its low CVSS base score, the real-world impact of CVE-2024-55550 is significant when considered in the context of its Known ransomware association and active exploitation. Confidentiality experiences a limited but meaningful impact (C:L in the CVSS vector). The authenticated admin attacker can read local files that should be restricted even at the administrator access level. While the vendor states that disclosure is limited to non-sensitive system information, attackers have been chaining this vulnerability with other MiCollab flaws (such as CVE-2024-41713) to amplify the overall impact.
The integrity and availability dimensions are not directly affected by this vulnerability in isolation (I:N, A:N). However, the information gathered through local file reads can serve as reconnaissance for deeper attacks. Configuration files, system information, internal network details, and application settings exposed through this vulnerability can inform subsequent exploitation steps that do impact integrity and availability.
The confirmed ransomware association is the most critical factor in assessing this vulnerability's real-world impact. Despite requiring administrative privileges (PR:H), the vulnerability has been weaponized in ransomware attack chains targeting Mitel MiCollab deployments. The EPSS score of 14.91% at the 94.4th percentile further confirms that this is not a theoretical risk but an actively exploited vulnerability. Organizations should treat this vulnerability with urgency proportional to the ransomware threat, not the low CVSS base score.
Exploit Maturity
CVE-2024-55550 has confirmed active exploitation in the wild and a direct ransomware association, making its exploit maturity far more concerning than the low CVSS score would suggest. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of January 28, 2025, and the Known ransomware classification means this vulnerability has been directly observed in ransomware attack campaigns.
The EPSS score of 14.91% at the 94.4th percentile indicates that CVE-2024-55550 is being exploited more actively than approximately 94% of all tracked vulnerabilities. In practice, this vulnerability is frequently chained with CVE-2024-41713, a critical path traversal flaw in the same MiCollab product, to create a more powerful attack sequence. The combination allows an unauthenticated attacker to first gain access through CVE-2024-41713 and then leverage CVE-2024-55550 for additional file system reconnaissance. Mitel has published security advisories addressing this vulnerability at their security advisories page.
Remediation
-
Update Mitel MiCollab to the latest patched version. Apply the security update referenced in Mitel's security advisory MISA-2024-0029. Ensure your MiCollab installation is updated beyond version 9.8 SP2 to a release that addresses this file read vulnerability.
-
Restrict and audit administrative access. Since CVE-2024-55550 requires administrative privileges, limit the number of MiCollab administrator accounts to the absolute minimum necessary. Enforce strong multi-factor authentication for all administrative access and review administrator account usage logs for any suspicious file access patterns.
-
Address CVE-2024-41713 simultaneously. This vulnerability is commonly chained with CVE-2024-41713, a critical path traversal flaw in MiCollab's NuPoint Unified Messaging component. Patching only one of these vulnerabilities leaves the attack chain partially intact. Ensure both vulnerabilities are remediated in the same maintenance window.
-
Isolate MiCollab from untrusted networks. Place MiCollab servers behind network segmentation controls that prevent direct access from the internet and from untrusted internal network zones. Use a reverse proxy or VPN for remote access to MiCollab administrative interfaces rather than exposing them directly.
-
Conduct a compromise assessment. Given the confirmed ransomware association, organizations running vulnerable MiCollab versions should proactively investigate for signs of compromise. Review server access logs, check for unusual file read operations, scan for indicators of ransomware staging activity, and verify the integrity of MiCollab configuration files and deployed components.
Technical Details
CVE-2024-55550 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, resulting in a low base score of 2.7. The vector indicates a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires high privileges (PR:H) but no user interaction (UI:N). The scope is unchanged (S:U), with only low confidentiality impact (C:L) and no integrity or availability impact.
The vulnerability exists in Mitel MiCollab's file handling functionality, where input sanitization fails to properly validate file path parameters supplied by authenticated administrators. When an administrator makes requests that include file path references, the application does not adequately filter or canonicalize the path input, allowing directory traversal sequences (such as "../") to escape the intended directory scope. This enables the attacker to read files from arbitrary locations on the server filesystem, constrained only by the operating system permissions of the MiCollab application process.
The high privilege requirement (PR:H) limits the direct exploitability, as the attacker must first obtain valid administrative credentials for the MiCollab platform. However, when combined with CVE-2024-41713 — a critical unauthenticated path traversal vulnerability in the same product — the privilege requirement is effectively bypassed. The attack chain allows an unauthenticated attacker to first exploit CVE-2024-41713 to gain unauthorized access to the MiCollab system and then leverage CVE-2024-55550 to read local files for intelligence gathering. Affected versions include Mitel MiCollab through 9.8 SP2 (version 9.8.1.201 and earlier).
Frequently Asked Questions
What is CVE-2024-55550?
CVE-2024-55550 is a local file read vulnerability in Mitel MiCollab that allows an authenticated administrator to read files from the server's filesystem due to insufficient input sanitization. While rated as low severity (CVSS 2.7), it has been actively exploited in ransomware campaigns.
Why is CVE-2024-55550 in the KEV catalog despite having a low CVSS score?
CISA adds vulnerabilities to the Known Exploited Vulnerabilities catalog based on confirmed active exploitation, not solely on CVSS scores. CVE-2024-55550 has been observed in real-world attacks, including ransomware campaigns, which makes it a significant threat regardless of its low base score. This is a strong example of why CVSS alone should not drive patching priority.
How is CVE-2024-55550 related to CVE-2024-41713?
Both vulnerabilities affect Mitel MiCollab and are frequently chained together in attacks. CVE-2024-41713 is a critical unauthenticated path traversal vulnerability that provides initial access, while CVE-2024-55550 is then used for local file reads to gather intelligence. Organizations should patch both vulnerabilities together to break the complete attack chain.
Is CVE-2024-55550 associated with ransomware?
Yes. CISA has classified CVE-2024-55550 as having a Known ransomware association, meaning it has been directly observed in ransomware attack campaigns targeting Mitel MiCollab deployments. This confirmed ransomware link makes immediate remediation critical for all affected organizations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.