{"id":"CVE-2024-55550","published":"2024-12-10T19:15:31Z","modified":"2026-08-04T05:16:31Z","title":"Mitel MiCollab Path Traversal Vulnerability","vendor":"Mitel","product":"MiCollab","tier":"core","eol":null,"description":{"text":"Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in Mitel MiCollab, through version 9.8 SP2, is caused by insufficient input sanitisation that lets file paths escape their restricted directory. An attacker with network access and administrative credentials, requiring no user interaction, can read local files, though the disclosure is limited to non-sensitive system information and the flaw does not permit file modification or privilege escalation.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:32:04Z"},"cvss":{"score":2.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.38155,"percentile":0.98555,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-01-07","dueDate":"2025-01-28","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55550","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-12-11","exploitedFirstSeen":"2024-12-11","ransomware":true,"evidence":[{"url":"https://digital.nhs.uk/cyber-alerts/2024/cc-4588","date":"2024-12-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-01-07"},{"url":"https://www.coveware.com/blog/2025/4/29/the-organizational-structure-of-ransomware-threat-actor-groups-is-evolving-before-our-eyes","date":"2025-05-01"},{"url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0828.pdf","date":"2025-08-28"},{"url":"https://www.recordedfuture.com/research/h1-2025-malware-and-vulnerability-trends","date":"2025-08-28"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://b9866c47-b467-4bc0-b154-6afa06da0ab5.usrfiles.com/ugd/b9866c_2578eb8c8ffe4257b30efef3ad0f953e.pdf","date":"2026-02-12"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.mitel.com/support/security-advisories","tags":["Vendor Advisory"]},{"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55550","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"Due to improper input sanitization, a user with administrative credentials can access and read arbitrary files on the MiCollab server.","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"Due to improper input sanitization, a user with administrative credentials can access and read arbitrary files on the MiCollab server.","confidence":"high"},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"secondary_impact","evidence":[],"comment":"Due to improper input sanitization, a user with administrative credentials can access and read arbitrary files on the MiCollab server. That data can then be exfiltrated.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-52803","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52803","exploited":true,"exploitedSince":"2025-01-07","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2024-55550","name":"Mitel MiCollab - Arbitary File Read","severity":"critical","path":"http/cves/2024/CVE-2024-55550.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55550.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1005"],"provenance":"source"},{"stage":"secondary","techniques":["T1041"],"provenance":"source"}],"timeline":[{"date":"2024-12-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55550","provenance":"source"},{"date":"2024-12-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://digital.nhs.uk/cyber-alerts/2024/cc-4588","provenance":"source"},{"date":"2025-01-07","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-01-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52803","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":28},"priority":{"score":74.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 688 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.71,"detail":"percentile 0.9856"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":1.89,"detail":"base score 2.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}