Loading vulnerability…
Unauthenticated path traversal in Mitel MiCollab NuPoint Unified Messaging
CVE-2024-41713 is a path traversal vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201). Insufficient input validation allows an unauthenticated attacker to gain unauthorized access to provisioning information and perform administrative actions. Successful exploitation can expose, corrupt, or delete user data and system configurations. Exploitation in the wild has been reported, including chaining with CVE-2024-55550.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation compromises confidentiality, integrity, and availability of the MiCollab server through unauthorized access to provisioning information, unauthorized administrative actions, and the ability to view, corrupt, or delete user data and system configurations. Provisioning information exposed by the vulnerability includes user and network information described as non-sensitive.
If you can’t patch tonight, do this now.
If upgrading is not possible, apply the Mitel-provided patch available for MiCollab releases 6.0 and above, following the vendor's knowledge-base instructions. No separate non-patching workaround specific to CVE-2024-41713 is established.
Patch, then assume compromise.
Apply the vendor-provided patch or upgrade to MiCollab 9.8 SP2 (9.8.2.12) or later, following Mitel advisory MISA-2024-0029. A subsequent vulnerability, CVE-2025-52913, bypasses the earlier fix; to address that related weakness as well, upgrade to MiCollab 9.8 SP3 (9.8.3.1) or later, or apply its vendor-provided patch following MISA-2025-0007.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.