Mitel MiCollab Path Traversal Vulnerability (CVE-2024-55550)
Severity: low · Patch status: unknown · Since 2025-01-07 · CVE-2024-55550
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server. CISA added CVE-2024-55550 to its Known Exploited Vulnerabilities catalog on Jan 7, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Jan 28, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
