PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-41713 Mitel CVE debrief

CVE-2024-41713 is a path traversal vulnerability in Mitel MiCollab that CISA added to the Known Exploited Vulnerabilities catalog on 2025-01-07. The KEV entry marks the issue as known exploited and notes known ransomware campaign use, so organizations should treat it as an active defensive priority and follow vendor guidance or discontinue use if mitigation is unavailable.

Vendor
Mitel
Product
MiCollab
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2025-01-07
Original CVE updated
2025-01-07
Advisory published
2025-01-07
Advisory updated
2025-01-07

Who should care

Teams responsible for Mitel MiCollab deployments, security operations, vulnerability management, and incident response.

Technical summary

The supplied official sources identify CVE-2024-41713 as a path traversal vulnerability affecting Mitel MiCollab. The corpus does not include affected versions, exploitation mechanics, or remediation details beyond CISA's reference to a Mitel security advisory. CISA lists the vulnerability as known exploited and indicates known ransomware campaign use.

Defensive priority

High. CISA KEV inclusion indicates active exploitation risk, and the supplied timeline gives a mitigation due date of 2025-01-28.

Recommended defensive actions

  • Review the Mitel security advisory referenced by CISA for vendor-supported mitigation steps.
  • Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable.
  • Inventory all MiCollab instances and confirm whether they are exposed or in scope.
  • Prioritize remediation before the KEV due date of 2025-01-28.
  • Review relevant logs and access activity for signs of unauthorized file or path access around affected systems.

Evidence notes

This debrief is limited to the supplied corpus and official links. CISA's KEV metadata identifies the vulnerability as Mitel MiCollab path traversal, dateAdded 2025-01-07, dueDate 2025-01-28, and knownRansomwareCampaignUse as Known. The source metadata also references Mitel security advisory MISA-2024-0029 and the NVD record, but the advisory text and NVD details are not included in the provided corpus.

Official resources

CVE published and added to CISA KEV on 2025-01-07; the supplied KEV due date is 2025-01-28. Use the CVE published date for timing context, not debrief generation time.