CVE-2024-35286

What it actually does

CVE-2024-35286 is an unauthenticated SQL injection vulnerability in the NuPoint Messenger component of Mitel MiCollab through version 9.8.0.33. Because user-supplied input is not sufficiently sanitized before being used in database queries, an attacker can manipulate SQL statements executed by the application. Successful exploitation can allow unauthorized querying of backend data, extraction of sensitive information, modification or deletion of records, and execution of database or management operations available to the application’s database context. With a CVSS score of 9.8, high EPSS probability, and weaponized exploit maturity, this should be treated as a critical remote attack surface issue.

Why it matters to the business

An exposed vulnerable MiCollab deployment could allow an unauthenticated internet-based attacker to compromise messaging-related data, disrupt collaboration and voicemail services, alter application configuration or records, and potentially use the system as a foothold for broader intrusion. Because exploitation is weaponized and the EPSS score is high, organizations running affected versions face an elevated likelihood of attempted exploitation even though the vulnerability is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a Mitel MiCollab system with the NuPoint Messenger component exposed and confirms that it is running an affected version through 9.8.0.33. The attacker then sends crafted HTTP requests containing SQL control characters or expressions in vulnerable input parameters. If the application incorporates that input into backend SQL statements without proper sanitization, the attacker can change the query logic, infer database behavior from responses or timing, and progressively extract data. Depending on database privileges and application behavior, the attacker may perform arbitrary database reads, alter records, or invoke management operations exposed through the database-backed application workflow. Weaponized exploit availability means exploitation may be automated and incorporated into scanning campaigns.

How to fix it

Upgrade Mitel MiCollab to a vendor-supported version that contains the fix for NuPoint Messenger SQL injection. Since the provided fixed-version data does not identify an exact target release, consult Mitel’s official advisory and upgrade guidance for CVE-2024-35286 and deploy the latest available MiCollab maintenance release beyond 9.8.0.33. Until patching is complete, restrict access to MiCollab and NuPoint Messenger interfaces to trusted networks or VPN users, block direct internet exposure where possible, apply web application firewall rules for SQL injection patterns, review database account privileges used by the application, and ensure reliable backups exist before remediation. Do not rely on WAF filtering as a permanent fix; input handling must be corrected through the vendor update.

How to confirm the fix worked

Confirm the deployed MiCollab version is newer than the affected range and matches the vendor-advised fixed release. Validate that NuPoint Messenger is no longer running version 9.8.0.33 or earlier. From an external and internal network perspective, verify that unauthenticated access to affected interfaces is either patched or appropriately restricted. Review recent web access logs for SQL injection payloads before and after remediation. If a vulnerability scanner or vendor-provided check is available, run an authenticated version assessment and confirm the issue is no longer reported. Avoid destructive exploit testing in production; use safe validation techniques such as version verification, configuration review, and controlled scanner checks.

Typical attack path

1. Discover internet-facing or otherwise reachable Mitel MiCollab services.
2. Identify instances running MiCollab through 9.8.0.33 with NuPoint Messenger enabled or reachable.
3. Send crafted unauthenticated requests containing SQL injection payloads to vulnerable input points.
4. Use response differences, error messages, or time delays to confirm injectable parameters.
5. Enumerate database structure and extract sensitive application or messaging data.
6. Modify, delete, or insert database records if the application database role permits write operations.
7. Abuse accessible management operations or harvested data to support persistence, lateral movement, or service disruption.

How to detect it

Investigate whether the vulnerable MiCollab or NuPoint Messenger interfaces received unauthenticated requests containing SQL injection syntax. Prioritize web server, reverse proxy, load balancer, WAF, and MiCollab application logs from the period since publication, especially for requests containing SQL keywords, quote-based query manipulation, comment delimiters, encoded payloads, or time-delay functions. Correlate suspicious requests with HTTP 500 responses, unusual 200 responses for malformed input, repeated parameter probing, and high-volume automated scanning from the same source. Review database audit logs for anomalous queries executed by the MiCollab application account, including metadata enumeration, bulk data reads, unexpected writes, or administrative operations. If exploitation is suspected, preserve appliance logs, database logs, WAF events, and relevant network telemetry; then assess for unauthorized data access, configuration changes, new accounts, altered messaging records, and unusual outbound connections. Known named threat actor attribution is not provided, but weaponized exploitation means opportunistic scanning and automated attacks should be expected.

• UNION SELECT
• UNION%20SELECT
• UNION/**/SELECT
• ' OR '1'='1
• " OR "1"="1
• OR 1=1
• OR%201%3D1
• '--
• %27--
• -- -
• %2D%2D
• /*
• %2F%2A
• */
• %2A%2F
• SLEEP(
• SLEEP%28
• BENCHMARK(
• BENCHMARK%28
• WAITFOR DELAY
• WAITFOR%20DELAY
• pg_sleep(
• pg_sleep%28
• information_schema
• INFORMATION_SCHEMA
• sys.objects
• sqlite_master
• SELECT @@version
• SELECT%20%40%40version
• xp_cmdshell
• LOAD_FILE(
• LOAD_FILE%28
• INTO OUTFILE
• INTO%20OUTFILE
• sqlmap
• sqlmap/

What your security team should do

• Treat this as a priority-one remediation item for any internet-facing Mitel MiCollab deployment because exploit maturity is weaponized and EPSS is high.
• Inventory all MiCollab instances and identify versions through 9.8.0.33, including appliances or downstream managed deployments.
• Patch to the vendor-fixed MiCollab release or latest supported maintenance version as soon as operationally feasible.
• Temporarily restrict NuPoint Messenger and MiCollab administrative or application interfaces to trusted networks only.
• Search historical web, reverse proxy, WAF, and application logs for SQL injection payloads and anomalous unauthenticated requests.
• Review database logs for unusual SELECT, UNION, metadata enumeration, time-delay functions, write operations, or administrative changes associated with the MiCollab application account.
• Rotate credentials or secrets stored in or accessible through the application database if exploitation is suspected.
• Monitor for post-exploitation behavior such as new accounts, configuration changes, unexpected service restarts, unusual outbound connections, or data export activity.