CVE-2024-55550

Deeper analysis

Mitel MiCollab through version 9.8 SP2 contains a path traversal vulnerability (CWE-22) that stems from insufficient input sanitization. An authenticated administrative user can supply crafted input to read arbitrary local files on the affected system. The flaw is rated CVSS 2.7 and permits access only to non-sensitive system information within the administrator’s existing privilege level; it does not enable file modification or privilege escalation.

An attacker who already possesses administrative credentials can exploit the issue over the network to retrieve files that would otherwise be inaccessible through normal administrative interfaces. Because the vulnerability requires high privileges, the attack surface is limited to insiders or compromised admin accounts, and successful exploitation yields only read access to constrained, non-sensitive resources.

Mitel has published security advisory MISA-2024-0029, available alongside general product security updates at mitel.com/support/security-advisories, that addresses the flaw. The advisory outlines the affected releases and directs administrators to apply the vendor-supplied remediation.

The CVE appears in CISA’s Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation. Its EPSS score rose from a low baseline after disclosure to a peak of 0.4272 on 2025-01-09 before receding to the current value of 0.1772, indicating a measurable increase in exploitation interest following public release.