PT-2024-7481 · Mitel · Mitel Micollab

Published 2024-07-24 · Updated 2025-06-24 · CVE-2024-41712

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.8.1.5

Description: The issue is related to insufficient validation of user input in the Web Conferencing Component, allowing an authenticated attacker to conduct a command injection attack. This could enable an attacker to execute arbitrary commands on the system within the context of the user.

Recommendations: For versions through 9.8.1.5, consider restricting access to the Web Conferencing Component until a patch is available, and ensure that all user input is properly validated to prevent command injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

BDU:2024-08861

CVE-2024-41712

Affected Products

Mitel Micollab

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-41712 · Security Note
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-24-0022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08861 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41712 · Vendor Advisory
• https://mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0022-001-v1.pdf · Note
• https://twitter.com/VulmonFeeds/status/1848622054863499761 · Twitter Post
• https://t.me/cvenotify/126451 · Telegram Post
• https://t.me/cvedetector/8571 · Telegram Post