External risk intelligence

Mitel MiCollab SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-35286

Mitel MiCollab is a unified communications and collaboration platform commonly deployed as a public-facing service to facilitate remote and external communications. Because it is designed to be accessible to users outside the internal network for messaging and collaboration, its surface is inherently internet-facing.

SQL Injection

Mitel Micollab

9.8.0.33 and earlier

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Mitel MiCollab's NuPoint Messenger could allow an unauthenticated attacker to access sensitive information or perform unauthorized actions by injecting malicious SQL code due to incomplete input validation. The main concern is confirming relevance and exposure.

Unauthenticated attackers can exploit this software weakness.
Confirms the need to verify if this system is in use.
Understand potential data access and operational risks.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input to the NuPoint Messenger feature within Mitel MiCollab. Since the application does not properly check user-provided data before using it in database queries, an attacker can inject malicious SQL commands. This allows them to bypass authentication, steal sensitive information, and potentially take control of the system.

No authentication needed to attack.
Input to NuPoint Messenger is unsanitized.
Sensitive data access and control operations.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could perform a SQL injection attack against the NuPoint Messenger component of Mitel MiCollab. This could allow them to access sensitive information, and potentially execute arbitrary database and management operations, given the right conditions.

System database and management operations.
Via unauthenticated network access.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in NuPoint Messenger, a component of Mitel MiCollab, impacts external-facing communication services, making the platform and security teams responsible for initial identification and risk assessment. The first practical step involves confirming the presence and accessibility of the affected technology, determining its criticality, identifying the accountable owner, and then planning remediation based on the identified risks.

Platform and security teams own this.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mitel MiCollab?

Mitel MiCollab is a unified communications and collaboration platform. It integrates various tools like voice, video, instant messaging, and conferencing into a single system. The NuPoint Messenger component specifically handles voicemail and messaging services, which serves as a core communication hub for organizations using the software.

What does CVE-2024-35286 mean for system security?

This vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command, or SQL injection (CWE-89). It means the application fails to properly filter input provided by users before processing it. An attacker can leverage this flaw to send malicious commands directly to the underlying database, potentially bypassing security controls to view data or modify system operations.

How does an attacker trigger this SQL injection?

An attacker triggers this vulnerability by sending specially crafted, malicious input to the NuPoint Messenger component. Because the system does not validate this data, the database interprets the input as executable code. Simply browsing the application or viewing standard pages without submitting specifically formatted data will not trigger this vulnerability.

Why is this CVE particularly relevant to my organization?

Halo Surface Signal indicates that Mitel MiCollab is typically deployed as a public-facing service to support remote work and external collaboration. Because the system is often intentionally accessible from the internet to facilitate communication, the attack surface is exposed to potential unauthorized parties without requiring them to be on your internal network.

How should I start responding to this advisory?

Your first step is to confirm if your organization uses Mitel MiCollab versions up to 9.8.0.33. Once identified, work with the system owner to determine the deployment's accessibility and criticality. Use this inventory to prioritize security updates and assess the potential impact on your specific database and management operations while planning for formal remediation.

References

www.mitel.com/support/security-advisories/mitel-product-security-ad…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.