CVE-2024-55550: Mitel MiCollab Path Traversal Vulnerability

Vulnerability summary

CVE-2024-55550 is a medium (CVSS 4.4) vulnerability in Mitel MiCollab. It is known to be exploited: CISA lists it, first on 07-01-2025. It has been used in ransomware campaigns. EPSS estimates a 38.16% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities.

Timeline

1. 10-12-2024
   PublishedVulnerability first disclosed.
2. 07-01-2025
   Added to CISA KEVExploitedMitel MiCollab Path Traversal Vulnerability
3. 28-01-2025
   CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 04-08-2026
   Last modifiedVulnerability information updated.

Description

Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.