CVE-2024-55550: 
Mitel MiCollab vulnerability analysis and mitigation

Mitel MiCollab through 9.8 SP2 contains a local file read vulnerability (CVE-2024-55550) that affects authenticated users with administrative privileges. The vulnerability stems from insufficient input sanitization and was discovered alongside CVE-2024-41713 by researchers at watchTowr Labs. The vulnerability was disclosed on December 5, 2024, and was later added to CISA's Known Exploited Vulnerabilities (KEV) Catalog on January 7, 2025, with a remediation deadline of January 28, 2025 (CISA KEV, Mitel Advisory).

The vulnerability (CVE-2024-55550) has been assigned a CVSS v3.1 base score of 2.7 (Low) with the vector string AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). When successfully exploited, the vulnerability allows authenticated administrators to conduct local file reads within the system due to insufficient input sanitization. The access is constrained to the admin access level, and the disclosure is limited to non-sensitive system information. Importantly, the vulnerability does not permit file modification or privilege escalation (NVD, Mitel Advisory).

The impact of this vulnerability is relatively limited due to its post-authentication nature and restriction to administrative users. A successful exploit allows access to resources constrained to the admin access level, with disclosure limited to non-sensitive system information. The vulnerability does not enable file modification or privilege escalation capabilities (Mitel Advisory).

Mitel has released MiCollab version 9.8 SP2 (9.8.2.12) which substantially mitigates the vulnerability. While this version provides significant mitigation, Mitel has indicated that the low severity issue will be fully addressed in future product updates. For customers unable to upgrade immediately, Mitel has provided a patch available for releases 6.0 and above. Detailed instructions for both the upgrade and patch installation can be found in Mitel Knowledge Base article SO8219 (Mitel Advisory).

The vulnerability has garnered attention from the cybersecurity community, particularly due to its potential to be chained with other vulnerabilities. Security researchers and organizations have highlighted the importance of addressing this vulnerability, especially given its inclusion in CISA's KEV catalog. Censys reported approximately 8,899 exposed Mitel MiCollab instances, with 54% of them located in the United States (Censys Report, Hacker News).