Introduction
Attackers can remotely access sensitive configuration data and execute administrative actions on thousands of exposed enterprise communication servers without authentication. The flaw that allows this is CVE-2025-52913, a critical path traversal vulnerability in the NuPoint Unified Messaging component of Mitel MiCollab. It affects business continuity and data security for organizations in many industries.
About Mitel and MiCollab: Mitel sells unified communications products to over 70 million business users in more than 100 countries. MiCollab, its flagship platform, combines voice, video, messaging, and collaboration, and it is widely deployed in enterprise and public-sector environments. A security flaw in this platform can disrupt essential communications and expose sensitive organizational data.
Technical Information
CVE-2025-52913 is a path traversal vulnerability (CWE-22) in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab. It affects all versions through 9.8 SP2 (9.8.2.12). The root cause is insufficient validation of user-supplied data that the component uses to build file paths. Attackers can craft HTTP requests containing directory traversal sequences such as ../ or encoded equivalents like %2e%2e%2f, move outside the intended directories, and reach restricted files or system resources.
The vulnerability is remotely exploitable and does not require authentication. Attackers can send malicious requests to endpoints that interact with the NPM component and use them to:
- View, corrupt, or delete user data
- Access or modify system configurations
- Execute unauthorized administrative actions
This issue is a bypass of CVE-2024-41713, which means the earlier patches did not fully fix the underlying input validation flaws. Over 20,000 internet-exposed MiCollab instances have been identified as vulnerable, and that number significantly increases the risk of automated exploitation.
Patch Information
Mitel has released MiCollab version 9.8 SP3 (9.8.3.1) and later updates to fix CVE-2025-52913. These updates improve input validation in the NPM component to prevent path traversal attacks.
Customers who cannot upgrade immediately can apply a patch for releases 6.0 and above. The patch also strengthens input validation, and Mitel Knowledge Base article SO8539, "MiCollab Security Update CVE-2025-52913 Path Traversal Vulnerability," describes it. You may need to contact a Mitel Authorized Partner to get access.
Apply the recommended update or patch promptly to protect against exploitation.
Reference: Mitel Security Advisory MISA-2025-0007
Detection Methods
There are several ways to detect CVE-2025-52913 in the NPM component of Mitel MiCollab:
1. Log Analysis:
- Look for requests with
../or%2e%2e%2fin server logs - Identify access to files or directories that are not normally requested
- Flag unauthorized administrative actions taken without authentication
2. Network Traffic Monitoring:
- Monitor for HTTP requests with encoded directory traversal patterns
- Detect unauthenticated requests to sensitive endpoints
3. Vulnerability Scanning: Use security scanners that are updated for CVE-2025-52913 and tailored for Mitel MiCollab.
4. File Integrity Monitoring: Watch for unauthorized changes to critical system files.
5. Access Control Review: Audit logs for unauthorized administrative actions.
6. Patch Verification: Confirm that systems run MiCollab version 9.8 SP3 (9.8.3.1) or later.
7. SIEM Integration: Correlate events and generate alerts for exploitation attempts.
Reference: Mitel Security Advisory MISA-2025-0007
Affected Systems and Versions
- Product: Mitel MiCollab
- Component: NuPoint Unified Messaging (NPM)
- Affected versions: All versions through 9.8 SP2 (9.8.2.12)
- Vulnerable configurations: Any deployment running affected versions, especially those with internet-exposed NPM endpoints
Vendor Security History
Mitel MiCollab has had recurring input validation vulnerabilities, including:
- CVE-2024-41713 (path traversal, NPM component)
- CVE-2024-35286 (arbitrary file read)
Mitel released patches for these, but bypasses such as CVE-2025-52913 show that its validation and security testing need to be stronger. Mitel publishes timely advisories and patch guidance, but it continues to struggle to fix the root causes completely.
