CVE-2024-41713

What it actually does

CVE-2024-41713 is an unauthenticated path traversal vulnerability in the NuPoint Unified Messaging component of Mitel MiCollab through 9.8 SP1 FP2, including 9.8.1.201. Insufficient validation of file path input can allow a remote attacker to reference files or directories outside the intended application path. Successful exploitation can allow unauthorized access to user data and system configuration files, and may also allow corruption or deletion of data depending on the vulnerable operation reached. Because exploitation does not require authentication and the CVSS score is 9.1 with very high EPSS, exposed systems should be treated as high-risk.

Why it matters to the business

An attacker could access, alter, or delete voicemail, messaging-related user data, and configuration information from an exposed MiCollab deployment. Operationally, this can disrupt unified communications, expose sensitive employee or customer communications, support credential or configuration theft, and create outage or recovery costs. This vulnerability is in CISA KEV, has documented active exploitation, is associated with ransomware activity, and the CISA remediation deadline of 2025-01-28 has passed, so unremediated systems represent an urgent business risk.

How an attack unfolds

An attacker first identifies an internet-accessible or network-accessible Mitel MiCollab server exposing the NuPoint Unified Messaging component. The attacker then sends crafted unauthenticated HTTP requests containing path traversal sequences such as ../ or encoded equivalents to force the application to resolve a file path outside the permitted directory. If the request succeeds, the attacker can read sensitive files such as application configuration, user data, voicemail-related content, or system files. Where vulnerable operations support file modification or deletion, the attacker may corrupt or remove user data or configuration. In ransomware-motivated activity, this access can be used for reconnaissance, theft of sensitive information, service disruption, credential harvesting, or as a foothold for broader compromise.

How to fix it

Upgrade Mitel MiCollab to a vendor-supported fixed version that addresses CVE-2024-41713. Systems running MiCollab through 9.8 SP1 FP2, including 9.8.1.201, should be considered affected unless Mitel guidance confirms otherwise. If exact fixed package versions are not available from existing asset data, obtain the latest Mitel security advisory and apply the recommended MiCollab/NuPoint Unified Messaging update or hotfix. Until patched, restrict NuPoint Unified Messaging and MiCollab administrative/application interfaces to trusted networks or VPN only, remove direct internet exposure, enforce firewall allowlists, and use WAF or reverse-proxy rules to block traversal patterns including ../, ..\, URL-encoded traversal, and double-encoded traversal. If exploitation is suspected, preserve logs, take forensic images where feasible, rotate credentials and secrets stored in MiCollab configuration, review backups, and validate integrity of user data and system configuration before returning the service to normal operation.

How to confirm the fix worked

Confirm the deployed MiCollab version is later than 9.8 SP1 FP2 / 9.8.1.201 or matches the Mitel advisory’s fixed release. Verify from package inventory, appliance management UI, and vendor patch status rather than relying only on banner information. From a controlled test host, confirm that requests containing traversal sequences to NuPoint Unified Messaging paths are rejected with an error such as 400, 403, or normalized safely, and do not return arbitrary file contents or allow modification/deletion outside expected directories. Review firewall and exposure scans to ensure MiCollab/NuPoint services are not reachable from untrusted networks. Validate WAF or reverse-proxy rules with encoded and double-encoded traversal payloads. Check application and web access logs after patching to confirm no successful 200/206 responses are returned for traversal attempts.

Typical attack path

1. Scan for externally reachable Mitel MiCollab or NuPoint Unified Messaging services.
2. Confirm the exposed service version or behavior is consistent with MiCollab through 9.8 SP1 FP2 / 9.8.1.201.
3. Send unauthenticated HTTP requests to NuPoint Unified Messaging endpoints with path traversal payloads such as ../, ..%2f, or double-encoded variants.
4. Attempt to read sensitive files, user data, voicemail-related content, or configuration files outside the intended application directory.
5. Use exposed configuration or credentials for follow-on access, or directly alter/delete accessible data if the vulnerable operation allows write or delete behavior.
6. Cover tracks by minimizing obvious errors or using encoded traversal strings that bypass simple logging or filtering controls.

How to detect it

Review web server, reverse-proxy, load balancer, WAF, and MiCollab/NuPoint Unified Messaging application logs for unauthenticated requests containing traversal strings directed at MiCollab or NuPoint paths. Prioritize events with HTTP 200, 206, 301/302 followed by success, 403 bypass attempts, or unusually large response sizes. Search for raw and encoded traversal patterns including ../, ..\, %2e%2e%2f, %2e%2e%5c, %252e%252e%252f, and mixed slash variants. Look for requests attempting to access sensitive Unix/Linux or application files such as passwd, shadow, hosts, configuration files, database files, voicemail/user data stores, or backup files. Correlate suspicious requests with file audit logs showing reads, writes, deletes, or permission changes under MiCollab/NuPoint data and configuration directories. Review authentication and directory-service logs after suspicious file access for credential reuse, new sessions, or unusual administrative activity. Because ransomware use has been reported, also inspect for unexpected service stoppage, mass file changes, deleted voicemail or configuration data, new scheduled tasks, suspicious shell execution from web/application service accounts, and unusual outbound connections from the MiCollab host.

• ../
• ..\\
• ..%2f
• ..%5c
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• %c0%ae%c0%ae%c0%af
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /proc/self/environ
• /proc/self/cmdline
• boot.ini
• win.ini
• MiCollab
• NuPoint
• NuPoint Unified Messaging
• NPM
• HTTP 200
• HTTP 206

What your security team should do

• Treat this as an emergency remediation item because it is actively exploited, listed in CISA KEV, associated with ransomware activity, and has a very high EPSS score.
• Immediately identify all Mitel MiCollab deployments and determine whether any are running through 9.8 SP1 FP2 / 9.8.1.201.
• Patch or upgrade affected systems to a Mitel-supported fixed release; if patching cannot be completed immediately, remove internet exposure and restrict access to trusted management networks or VPN.
• Search historical web, reverse-proxy, WAF, and application logs for traversal payloads against MiCollab or NuPoint Unified Messaging endpoints, especially successful 200/206 responses.
• If suspicious access is found, assume possible exposure of configuration data and user communications; rotate relevant credentials, review integrated directory or messaging credentials, and validate system configuration integrity.
• Add temporary WAF/SIEM detections for traversal payloads, URL-encoded traversal, and double-encoded traversal against MiCollab paths.
• Verify backups of MiCollab/NuPoint data and configuration are current, offline or immutable, and restorable in case corruption or deletion occurred.
• Monitor for follow-on activity, including anomalous authentication attempts, new administrative access, unexpected configuration changes, and unusual outbound connections from the MiCollab server.