{"id":"CVE-2024-41713","published":"2024-10-21T21:15:06Z","modified":"2026-08-04T05:16:30Z","title":"Mitel MiCollab Path Traversal Vulnerability","vendor":"Mitel","product":"MiCollab","tier":"core","eol":null,"description":{"text":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab, through version 9.8 SP1 FP2 (9.8.1.201), stems from insufficient input validation. An unauthenticated attacker with network access can exploit it without user interaction to reach files outside the intended directories, gaining the ability to view, corrupt, or delete user data and system configurations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:51Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.97209,"percentile":0.99895,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-01-07","dueDate":"2025-01-28","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-41713 ","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-12-10","exploitedFirstSeen":"2024-12-10","ransomware":true,"evidence":[{"url":"https://www.greynoise.io/blog/from-poc-to-attacker-interest-in-hours-real-time-insights-into-mitel-micollab-vulnerabilities","date":"2024-12-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-11&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-11"},{"url":"https://digital.nhs.uk/cyber-alerts/2024/cc-4588","date":"2024-12-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-12&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-13&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-15&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-23&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-24&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-25&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-27&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-27"}],"evidenceTotal":463,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41713","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"This path traversal vulnerability can lead to privilege escalation on MiCollab, which can then lead to other exploits such as CVE-2024-55550.","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"This path traversal vulnerability can lead to privilege escalation on MiCollab, which can then lead to other exploits such as CVE-2024-55550.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-39339","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-39339","exploited":true,"exploitedSince":"2025-01-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2024-12-05","earliestUrl":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","repos":[{"name":"watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","url":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","stars":20,"created":"2024-12-05"},{"name":"zxj-hub/CVE-2024-41713POC","url":"https://github.com/zxj-hub/CVE-2024-41713POC","stars":0,"created":"2024-12-21"},{"name":"Sanandd/cve-2024-CVE-2024-41713","url":"https://github.com/Sanandd/cve-2024-CVE-2024-41713","stars":0,"created":"2024-12-21"},{"name":"amanverma-wsu/CVE-2024-41713-Scan","url":"https://github.com/amanverma-wsu/CVE-2024-41713-Scan","stars":0,"created":"2025-01-11"},{"name":"gunyakit/CVE-2024-41713-PoC-exploit","url":"https://github.com/gunyakit/CVE-2024-41713-PoC-exploit","stars":0,"created":"2025-05-18"}]},"nuclei":[{"id":"CVE-2024-41713","name":"Mitel MiCollab - Authentication Bypass","severity":"high","path":"http/cves/2024/CVE-2024-41713.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41713.yaml"}],"first":{"date":"2024-12-05","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1005"],"provenance":"source"}],"timeline":[{"date":"2024-10-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41713","provenance":"source"},{"date":"2024-12-05","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","provenance":"source"},{"date":"2024-12-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.greynoise.io/blog/from-poc-to-attacker-interest-in-hours-real-time-insights-into-mitel-micollab-vulnerabilities","provenance":"source"},{"date":"2025-01-07","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-01-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-39339","provenance":"source"}],"speed":{"daysToPublicExploit":45,"firstExploitFrom":"PoC-in-GitHub","daysToKev":78},"priority":{"score":79.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 690 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}