{"id":"CVE-2024-41713","aliases":["EUVD-2024-39339","GHSA-8v9w-9wj4-52p3"],"status":"published","title":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8...","description":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.97209,"percentile":0.99895,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2024-10-21T00:00:00Z","modified":"2026-08-04T05:16:30Z","kev":{"date_added":"2025-01-07","due_date":"2025-01-28","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2025-01-07"},{"source":"kev","since":"2025-01-07"}],"exploits":[{"source":"pocgithub","id":"watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","title":"watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","date":"2024-12-05","url":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713"},{"source":"pocgithub","id":"Sanandd/cve-2024-CVE-2024-41713","title":"Sanandd/cve-2024-CVE-2024-41713","date":"2024-12-21","url":"https://github.com/Sanandd/cve-2024-CVE-2024-41713"},{"source":"pocgithub","id":"zxj-hub/CVE-2024-41713POC","title":"zxj-hub/CVE-2024-41713POC","date":"2024-12-21","url":"https://github.com/zxj-hub/CVE-2024-41713POC"},{"source":"pocgithub","id":"amanverma-wsu/CVE-2024-41713-Scan","title":"amanverma-wsu/CVE-2024-41713-Scan","date":"2025-01-11","url":"https://github.com/amanverma-wsu/CVE-2024-41713-Scan"},{"source":"pocgithub","id":"gunyakit/CVE-2024-41713-PoC-exploit","title":"gunyakit/CVE-2024-41713-PoC-exploit","date":"2025-05-18","url":"https://github.com/gunyakit/CVE-2024-41713-PoC-exploit"},{"source":"nuclei","id":"CVE-2024-41713","title":"Mitel MiCollab - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41713.yaml"}],"products":[{"vendor":"mitel","product":"micollab"}],"references":[{"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41713","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41713"},{"url":"https://github.com/advisories/GHSA-8v9w-9wj4-52p3"}],"sources":{"cve":[{"id":"CVE-2024-41713","description":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.","status":"published","published":"2024-10-21T00:00:00Z","modified":"2026-08-04T03:55:35.454Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-39339","description":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.","status":"published","published":"2024-10-21T00:00:00Z","modified":"2026-08-04T03:55:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"exploited_since":"2025-01-07","updated_at":"2026-11-02T18:02:23.68186Z"}],"ghsa":[{"id":"GHSA-8v9w-9wj4-52p3","title":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8...","description":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.","status":"published","published":"2024-10-21T21:30:54Z","modified":"2025-10-22T00:33:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:07.67458Z"}],"kev":[{"id":"CVE-2024-41713","title":"Mitel MiCollab Path Traversal Vulnerability","description":"Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.","cwes":["CWE-22"],"kev":{"date_added":"2025-01-07","due_date":"2025-01-28","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-41713","description":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.","status":"published","published":"2024-10-21T21:15:06.47Z","modified":"2026-08-04T05:16:30.767Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:33.928543Z"}]}}