CISA Flags Critical Flaws in Mitel and Oracle Systems Amid Active Exploitation

CVE-2020-2883 is an easily exploitable, unauthenticated vulnerability in the Core component of Oracle WebLogic Server that is reachable over the network via the T3 and IIOP protocols. An attacker with network access to a WebLogic listener can trigger the flaw without credentials or user interaction, and successful exploitation results in takeover of Oracle WebLogic Server, with high confidentiality, integrity, and availability impact. The supported affected releases are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Oracle rates the flaw CVSS 9.8 (Critical), and it carries a very high EPSS of 94.9% (100th percentile), indicating near-certain near-term exploitation likelihood. CISA added it to the Known Exploited Vulnerabilities catalog on 2025-01-07 amid active exploitation, with reports of hackers targeting WebLogic servers and the flaw included in Oracle's January 2025 patch cycle.

Do: Apply the Oracle Critical Patch Update fixes for WebLogic Server — Oracle's January 2025 patch release includes WebLogic fixes, and the affected releases (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0) must be patched per vendor instructions. Until patched, restrict network access to the T3 and IIOP listeners (e.g., firewall them to trusted hosts only), prioritize internet-facing instances, and hunt for signs of exploitation. Per CISA KEV guidance, apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

CVE-2024-41713 is a path traversal vulnerability (CWE-22) in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201), caused by insufficient input validation. An unauthenticated remote attacker can send crafted requests that traverse the file system without needing credentials or user interaction. A successful exploit grants unauthorized access allowing the attacker to view, corrupt, or delete users' data and system configurations, and reporting indicates exposure to unauthorized file and administrative access. Any organization running an affected MiCollab version, particularly with the NPM component reachable from untrusted networks, is at risk. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-01-07 with known ransomware use, and EPSS places it in the top percentile with a 98.1% probability of exploitation within 30 days.

Do: Upgrade MiCollab to a release later than 9.8 SP1 FP2 (9.8.1.201) per Mitel's advisory; if patching is not immediately possible, apply the vendor's mitigations or restrict/discontinue use of the NPM component, especially where it is internet-facing, as required by the CISA KEV entry. Given known ransomware use and reported admin-access abuse, hunt for signs of exploitation on exposed MiCollab servers (unexpected file changes, configuration tampering, and follow-on lateral movement).

Mitel MiCollab contains a path traversal vulnerability (CWE-22) caused by insufficient input sanitization of file-path input. It is triggered when an authenticated user with administrative privileges submits crafted paths that escape the intended directory, allowing the attacker to read local files on the MiCollab server. On its own the flaw requires admin credentials, but it can be chained with CVE-2024-41713, an unauthenticated remote arbitrary file-read flaw in the same product, enabling remote attackers to read files without valid credentials. Any organization running Mitel MiCollab is affected; the available data does not specify affected or fixed version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-07 with known ransomware use, although no public proof-of-concept is known.

Do: Apply Mitel's updates or mitigations per the vendor advisory immediately, prioritizing internet-facing MiCollab servers, and address the chained CVE-2024-41713 issue in the same maintenance cycle; where mitigations are unavailable, restrict or discontinue use per CISA KEV guidance. Check the Mitel advisory for exact fixed versions (not provided here), limit administrative access to trusted users, and review server logs for evidence of arbitrary file reads or follow-on ransomware activity.