{"id":"CVE-2024-41713","published":"2024-10-21T21:15:06Z","modified":"2026-08-04T05:16:30Z","title":"Mitel MiCollab Path Traversal Vulnerability","vendor":"Mitel","product":"MiCollab","tier":"core","eol":null,"description":{"text":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab, through version 9.8 SP1 FP2 (9.8.1.201), stems from insufficient input validation. An unauthenticated attacker with network access can exploit it without user interaction to reach files outside the intended directories, gaining the ability to view, corrupt, or delete user data and system configurations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:51Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.97209,"percentile":0.99895,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2025-01-07","dueDate":"2025-01-28","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-41713 ","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-12-10","exploitedFirstSeen":"2024-12-10","ransomware":true,"evidence":[{"url":"https://www.greynoise.io/blog/from-poc-to-attacker-interest-in-hours-real-time-insights-into-mitel-micollab-vulnerabilities","date":"2024-12-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-11&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-11"},{"url":"https://digital.nhs.uk/cyber-alerts/2024/cc-4588","date":"2024-12-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-12&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-13&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-15&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-23&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-24&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-25&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-27&host_type=src&vulnerability=cve-2024-41713","date":"2024-12-27"}],"evidenceTotal":463,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41713","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"This path traversal vulnerability can lead to privilege escalation on MiCollab, which can then lead to other exploits such as CVE-2024-55550.","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"This path traversal vulnerability can lead to privilege escalation on MiCollab, which can then lead to other exploits such as CVE-2024-55550.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-39339","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-39339","exploited":true,"exploitedSince":"2025-01-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2024-12-05","earliestUrl":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","repos":[{"name":"watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","url":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","stars":20,"created":"2024-12-05"},{"name":"zxj-hub/CVE-2024-41713POC","url":"https://github.com/zxj-hub/CVE-2024-41713POC","stars":0,"created":"2024-12-21"},{"name":"Sanandd/cve-2024-CVE-2024-41713","url":"https://github.com/Sanandd/cve-2024-CVE-2024-41713","stars":0,"created":"2024-12-21"},{"name":"amanverma-wsu/CVE-2024-41713-Scan","url":"https://github.com/amanverma-wsu/CVE-2024-41713-Scan","stars":0,"created":"2025-01-11"},{"name":"gunyakit/CVE-2024-41713-PoC-exploit","url":"https://github.com/gunyakit/CVE-2024-41713-PoC-exploit","stars":0,"created":"2025-05-18"}]},"nuclei":[{"id":"CVE-2024-41713","name":"Mitel MiCollab - Authentication Bypass","severity":"high","path":"http/cves/2024/CVE-2024-41713.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41713.yaml"}],"first":{"date":"2024-12-05","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1005"],"provenance":"source"}],"timeline":[{"date":"2024-10-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41713","provenance":"source"},{"date":"2024-12-05","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","provenance":"source"},{"date":"2024-12-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.greynoise.io/blog/from-poc-to-attacker-interest-in-hours-real-time-insights-into-mitel-micollab-vulnerabilities","provenance":"source"},{"date":"2025-01-07","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-01-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-39339","provenance":"source"}],"speed":{"daysToPublicExploit":45,"firstExploitFrom":"PoC-in-GitHub","daysToKev":78},"priority":{"score":76.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 691 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}