Mitel MiCollab Path Traversal Vulnerability (CVE-2024-55550)

What is affected, what to do

Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Mitel MiCollab lte *..9.8.1.201

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Confirm whether Mitel MiCollab 9.8 SP2 or earlier (up to and including 9.8.1.201) is running anywhere in the estate, including NuPoint, AWV, client and server components. Cross-check CMDB with an active scan on TCP/443 and 8443.
   • Apply Mitel Security Advisory MISA-2024-0029: upgrade to MiCollab 9.8 SP3 or later per the current vendor advisory. For managed-service deployments, escalate to the provider with a binding patch-window commitment inside 72 hours.
   • Immediately restrict external access to the MiCollab admin interface (NPM portal, Server Manager on TCP/443) to a dedicated admin network or VPN until patched. Because the chain with CVE-2024-41713 turns this into an unauthenticated read, internet exposure is the primary risk driver.
   • Rotate all MiCollab Server Manager and AMC connector admin credentials, especially where logs suggest exposure before 7 January 2025. Terminate active sessions via Server Manager → Users.
   • Enable a reverse-proxy or WAF rule that blocks ../, ..%2f, %2e%2e%2f and double-encoded variants on all MiCollab vhosts, with particular focus on the ReconcileWizard and npm-pwg endpoints targeted by the CVE-2024-41713 chain.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place MiCollab servers in a dedicated voice VLAN with explicit egress allowlisting. Admin access only via a jump host with MFA; no direct reachability from user subnets to TCP/443.
   • WAF / reverse proxy: path-traversal signature on URI and query string plus a deny-list for the known vulnerable endpoints (/npm-pwg/, ReconcileWizard, getFile, getLogs). Enable request normalisation to collapse double encoding before pattern matching.
   • Admin account hardening: minimise admin role membership, eliminate shared admin accounts, enforce password length ≥ 16 characters plus MFA via an external IdP (SAML) where supported. The flaw requires admin rights, so every shared-account abuse becomes a direct lever.
   • Filesystem hardening: restrict readability of sensitive files (/etc/shadow, /opt/mitel/ config, keystore files) to the service account; enforce SELinux or AppArmor profiles for the MiCollab web process where the appliance allows it.
   • Increase local log retention on the MiCollab server to at least 90 days and forward access logs via syslog to the central SIEM so that evidence survives any post-exploitation cleanup by an admin-level attacker.
3. 03

   Runbook step 3

   Detection rules

   • Web access log (Apache/Tomcat on the MiCollab server): hunt for patterns such as GET .*(\.\./|%2e%2e%2f|%252e%252e%252f).* on 443/8443. Sigma shape: selection: cs-uri-stem|contains: ['../', '%2e%2e'] → high-severity alert.
   • Chain indicator: HTTP requests to ReconcileWizard or npm-pwg without a preceding successful admin login tied to the same session cookie — a strong signal of chaining with CVE-2024-41713.
   • Admin login monitoring: Server Manager logins from unusual source IPs, especially outside the admin VLAN or outside business hours. KQL shape: MitelAuditLog | where EventType == "AdminLogin" and SourceIP !in (AdminSubnets).
   • Linux auditd on the appliance: web-server UID reading paths outside /opt/mitel/www/ (e.g. /etc/, /root/, /var/log/). Watch rule: -w /etc -p r -k mitel_traversal.
   • Network telemetry (Zeek/Suricata): signature on HTTP URIs containing more than three ../ sequences targeting MiCollab IPs; complement with a Suricata rule combining Mitel user-agent patterns and traversal payloads.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.

Source: NCSC NZ (CC BY 4.0), pwn.watch, CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Mitel Mitel MiCollab

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

References & sources

• mitel.comsupport/security-advisories
• mitel.comMitel advisory: Mitel MiCollabpwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55550government-resource
• pwn.watchpwn.watch: Mitel MiCollab: 2 exploited vulnerabilities (CVE-2024-41713, CVE-2024-55550)pwn-watch
• NVD (NIST)NVD: CVE-2024-41713pwn-watch
• NVD (NIST)NVD: CVE-2024-55550pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch