CVE-2024-35286: Mitel MiCollab SQL injection, unauthenticated
The short version: Mitel MiCollab's NuPoint Messenger component has a SQL-injection flaw (CVE-2024-35286) that lets an unauthenticated attacker query and manipulate the backend database — reaching sensitive information and management operations. It is not in CISA's KEV catalog, but it's an unauthenticated, high-impact flaw on an internet-facing platform, so treat it seriously. If you run an affected MiCollab build, apply Mitel's fix. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated SQL injection reaching data and management operations |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (per NVD's secondary/ADP CVSS; a primary NVD base score was not published at time of writing) |
| EPSS | ~65.56% · 99.18th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in-the-wild by an authoritative catalog at time of writing |
| Vulnerability type | CWE-89 SQL injection → sensitive data access and arbitrary database/management operations |
| Requires authenticated session? | No — unauthenticated |
| Affected | Mitel MiCollab through 9.8.0.33 |
| Fixed in | See Mitel advisory 24-0014 for the fixed release |
What you need to know
MiCollab is an internet-facing collaboration server. CVE-2024-35286 is a SQL injection in the NuPoint Messenger (NPM) component caused by insufficient sanitization of user input. An unauthenticated attacker injects SQL through the vulnerable parameter and can read sensitive information and, per Mitel, execute arbitrary database and management operations.
- How they find it — internet-wide scanning surfaces exposed MiCollab panels; the affected component is part of the standard deployment.
- How they use it — crafted input manipulates backend queries, returning data or driving management actions.
- What it leads to — disclosure of sensitive data and potentially deeper control of the application's data and operations.
How serious we see it
High — unauthenticated SQL injection on an internet-facing communications platform is a direct path to sensitive data and management operations.
NVD carries a secondary CVSS of 9.8; a primary NVD base score wasn't published at the time of writing, so we lead with our own real-world read. This CVE is not in KEV and we're not asserting confirmed mass exploitation — but "unauthenticated" plus "database and management operations" is serious on its own, and it sits alongside a companion MiCollab path-traversal flaw (CVE-2024-41713) that is KEV-listed, so affected estates should treat both together. The reassuring part: it affects a defined version range, the fix is published, and exposure is quick to determine.
Recommendations
- Patch now. Apply the fixed MiCollab release identified in Mitel's advisory 24-0014 (and address CVE-2024-41713 in the same pass).
- Hunt. Review application and database logs for injection patterns and anomalous queries against NuPoint Messenger.
- If compromised, respond. Rotate exposed credentials and secrets, and review the database for unauthorized changes.
- Reduce exposure. Restrict MiCollab's internet-facing surface; keep management behind trusted networks.
- Confirm your exposure first. Verify whether you run MiCollab and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing MiCollab panels from little more than your domain, fingerprints the product and version, and flags exposure tied to this flaw. We detect and prioritize the exposed, affected server rather than exploiting it — and because MiCollab estates often carry both this SQL-injection issue and the KEV-listed traversal flaw, the outside-in view surfaces the appliance so you can remediate the pair before either is used against you.