Vulnerability record · CVE-2024-55550 · published 10 December 2024
CVE-2024-55550: Mitel MiCollab path traversal allows admin local file read
Mitel · Micollab
Mitel MiCollab through 9.8 SP2 has a path traversal flaw (CWE-22) caused by insufficient input sanitization. An authenticated attacker with administrative privileges can read local files, though the disclosure is limited to non-sensitive system information and does not allow file modification or privilege escalation.
Description
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Automated analysis
high priorityDespite a low CVSS score, it is in CISA KEV with known ransomware use and high EPSS, indicating real-world exploitation.
What it is
Mitel MiCollab through 9.8 SP2 has a path traversal flaw (CWE-22) caused by insufficient input sanitization. An authenticated attacker with administrative privileges can read local files, though the disclosure is limited to non-sensitive system information and does not allow file modification or privilege escalation.
Impact
The attacker gains read access to resources constrained to the admin access level, limited to non-sensitive system information. No file modification or privilege escalation is possible.
Attack surface
Reachable over the network (AV:N) with no user interaction (UI:N), but requires high privileges (PR:H), meaning a valid administrative account is needed.
Exploitation
CISA added it to KEV on 2025-01-07 with known ransomware campaign use, and EPSS is 0.379 (98.5th percentile), indicating active exploitation in the wild.
What to do
- Apply the vendor mitigation or update per Mitel security advisory MISA-2024-0029.
- If no fix is available, discontinue use of the product as directed by CISA.
- Restrict administrative access to MiCollab to trusted networks and accounts.
- Audit and rotate credentials for administrative accounts that may be exposed.
Detection
- Monitor MiCollab logs for path traversal patterns in requests from administrative sessions.
- Alert on unexpected local file read activity by admin users.
- Review administrative account activity for anomalous file access sequences.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-55550 to the Known Exploited Vulnerabilities catalog on 7 January 2025 as "Mitel MiCollab Path Traversal Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 28 January 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.mitel.com/support/security-advisories | Vendor Advisory |
| https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55550 | US Government Resource |
Track CVE-2024-55550 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-55550), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
