← CVE catalog

CVE-2024-41713

Critical CVSS 9.1 Known exploited

Published 2024-10-21 · last changed 2026-08-04 · added to CISA KEV 2025-01-07

This one is being exploited in the wild.

CISA added CVE-2024-41713 to the Known Exploited Vulnerabilities catalog on 2025-01-07. Federal agencies are required to remediate it on a deadline. If you have affected machines, this is the class of finding that moves ahead of the rest of the queue.

The fix

We hold no Microsoft remediation data for CVE-2024-41713, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.

Sources

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N