CVE-2024-41713: Mitel MiCollab path traversal, actively exploited
The short version: Mitel MiCollab — a unified-communications and collaboration platform — has a path-traversal flaw (CVE-2024-41713) in its NuPoint Unified Messaging component that lets an unauthenticated attacker traverse the filesystem and reach files, user data, and system configuration. It's in CISA's KEV catalog and ransomware-associated. If you run MiCollab at or below 9.8 SP1 FP2, apply the fix in Mitel's advisory. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated path traversal on an exposed comms platform, KEV-listed |
| CVSS v3.1 (NVD) | 9.1 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | ~98.07% · 99.91th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-01-28; associated with known ransomware campaigns |
| Known exploited? | Yes — exploited in the wild |
| Vulnerability type | CWE-22 path traversal → unauthorized access to files, user data, and configuration |
| Requires authenticated session? | No — unauthenticated |
| Affected | Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) |
| Fixed in | See Mitel advisory MISA-2024-0029 for the fixed release |
What you need to know
MiCollab is an internet-facing collaboration server, so its web components are commonly reachable. CVE-2024-41713 is a path traversal in the NuPoint Unified Messaging (NPM) component caused by insufficient input validation. An unauthenticated attacker supplies a crafted path and steps outside the intended directory, gaining access that — in Mitel's words — could allow viewing, corrupting, or deleting users' data and system configurations.
- It's unauthenticated and network-reachable. No login, no chain — a crafted request does the traversal.
- It reaches sensitive data and configuration. Beyond a simple file read, the access can extend to user data and system settings.
- It's KEV-listed and ransomware-associated. Exposed, unpatched servers are being found and hit.
How serious we see it
High — unauthenticated traversal on an internet-facing communications platform, confirmed exploited and ransomware-associated.
NVD's 9.1 reflects strong confidentiality and integrity impact with no availability effect. We rate it High rather than automatically Critical because the direct primitive is filesystem traversal rather than immediate code execution — but its role in real intrusions, and its KEV listing, keep it firmly near the top. The bounded, reassuring part: it affects a defined version range, the fix is published, and exposure is quick to determine.
Recommendations
- Patch now. Apply the fixed MiCollab release identified in Mitel's advisory MISA-2024-0029.
- Hunt. Review web and application logs for traversal patterns against the NuPoint messaging endpoints and any anomalous file access.
- If compromised, respond. Rotate exposed credentials and secrets, review configuration for tampering, and treat it as a potential ransomware precursor.
- Reduce exposure. Restrict MiCollab's internet-facing surface to what's necessary; place management behind trusted networks.
- Confirm your exposure first. Verify whether you run MiCollab and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing MiCollab panels from little more than your domain, fingerprints the product and version, and flags exposure tied to this KEV-listed, actively exploited flaw — surfaced at the top of your results because it's in KEV and ransomware-associated. We detect and prioritize the exposed, affected server; the continuous outside-in view means it was already mapped, so you can go straight to patch-and-verify.