CVE-2024-35285

The vulnerability results from insufficient sanitization of input parameters in the NuPoint Messenger component. An attacker can pass specially crafted input data containing malicious system commands (command injection), which are then executed by the application in the server context. The lack of user identity verification (auth bypass) makes the attack accessible to anyone with network access to the system.

An attacker can take full control of the vulnerable system — gain access to confidential data, modify server resources, or disrupt its availability, which corresponds to a complete breach of confidentiality, integrity, and availability.

Patches available from the manufacturer should be applied according to the references — details in the Mitel security bulletin Product Security Advisory 24-0013 available at: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0013

Mitel MiCollab in versions up to and including 9.8.0.33 (NuPoint Messenger component)