Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 4.4epss 38%
from disclosure to weapon
Published on NVDDec 10
CISA KEV+28d
exploitation probability
38%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2025-01-28
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
In short
An admin user in Mitel MiCollab up to version 9.8 SP2 can read local files on the system due to weak input checking. This could expose non-sensitive system information, but doesn't allow changing files or gaining higher privileges.
Technical detail
Path traversal vulnerability (CWE-22) in Mitel MiCollab ≤9.8 SP2 requires authenticated administrative access; insufficient input sanitization on file path parameters allows local file read operations restricted to admin-level resources and non-sensitive system data disclosure.
Summary generated and translated by AI from the official description.
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.