PT-2024-7508 · Mitel · Mitel Micollab

Published 2024-10-04 · Updated 2025-07-07 · CVE-2024-47912

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions prior to 9.8 SP1 FP2 (9.8.1.201)

Description: A vulnerability in the AWV Conferencing component could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to access and delete sensitive information. The vulnerability is related to deficiencies in the authentication procedure, which may enable a remote attacker to gain unauthorized access to read, modify, or delete data.

Recommendations: For Mitel MiCollab versions prior to 9.8 SP1 FP2 (9.8.1.201), update to version 9.8 SP1 FP2 (9.8.1.201) or later to resolve the issue. As a temporary workaround, consider restricting access to the AWV Conferencing component to minimize the risk of exploitation.

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

BDU:2024-08897

CVE-2024-47912

Affected Products

Mitel Micollab

References · 6

• https://mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0027 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08897 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47912 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47912 · Vendor Advisory
• https://vuldb.com/?id.281446 · Note
• https://t.me/cvenotify/127884 · Telegram Post