CVE-2024-55550

LowActively exploited (CISA KEV)Known to be used in ransomware campaigns

Description

Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.

SeverityLow
CVSS2.7
Exploit probability—
ProductMitel MiCollab
PublishedDec 10, 2024
First seenDec 10, 2024
Added to KEVJan 7, 2025

How to fix

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date: Jan 28, 2025

Affected products

ProductAffected versionsFixed in
mitel micollabv ≤ 9.8.1.201—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.

CVE-2024-55550 · Mitel MiCollab · Dark Radar