Mitel MiCollab: 2 exploited vulnerabilities (CVE-2024-41713, CVE-2024-55550)
Mitel MiCollab
CVE-2024-41713: Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server. CVE-2024-55550: Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server. Added to CISA KEV on 2025-01-07.
Why this severity: CVSS 9.1 (CISA ADP, v3.1); actively exploited (CISA KEV); known ransomware use
- Started
- Jan 7, 2025
- Closed
- Jan 7, 2025
Affected
- See vendor advisory / CISA notes (versions not always listed in KEV feed)
Fixed in
- See vendor advisory linked in sources
Timeline2
CISA added CVE-2024-41713 to the KEV catalog (due 2025-01-28).
CISA added CVE-2024-55550 to the KEV catalog (due 2025-01-28).
Advisories4
Notes & caveats
Derived from CISA KEV JSON feed catalogVersion 2026.10.21. CVSS from the CVE record (cvelistV5). Exact affected/fixed version strings are not always in the KEV record; verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier; many entries are older CVEs newly confirmed as exploited in 2025).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
