Critical vulnerability reported in Mitel MiCollab VoIP software
Take action: If you are running Mitel's MiCollab VoIP telephony software, this is a set of must-patches. The detailed research of WatchTowr will quickly be turned into an exploit.
Learn More
A critical security vulnerability has been discovered in Mitel's MiCollab VoIP telephony software, with researchers warning of significant risks to over 16,000 internet-exposed instances.
Two zero-day vulnerabilities have been identified by Singapore-based cybersecurity firm watchTowr:
- CVE-2024-41713 (CVSS score 9.8) - Path traversal vulnerability in NuPoint Unified Messaging (NPM) component. Allows unauthenticated remote attackers to gain unauthorized access. Affected versions: 9.7 and above, patched in MiCollab 9.8 SP2 (version 9.8.2.12) released on October 9
- CVE-2024-35286 (CVSS score 9.8) - SQL Injection in NuPoint Unified Messaging (NPM) component. Affected Versions: 9.8.0.33 and earlier.
- Arbitrary file read vulnerability, currently unpatched (patch expected first week of December 2024)
Users are advised to update their systems as soon as possible.
