Mitel MiCollab VoIP Software: Zero-Day Vulnerability Alert

Security researchers are warning of a newly discovered zero-day vulnerability in widely used VoIP telephony software, a discovery that comes as the United States struggles to evict Chinese nation-state hackers from telecom networks.

See Also: OnDemand | Where Did the Hackers Go? They Ran(somware): Insights into Ransomware Recovery

The software in question is the MiCollab software suite from Canada-based Mitel. At least 16,000 instances are publicly exposed to the internet and in need of immediate patching against zero-day vulnerabilities that make them “juicy targets” for advanced persistent threat groups, Singapore-based cybersecurity startup watchTowr said in a Thursday blog post.

One of the zero-day flaws recently discovered by the organization in the devices has yet to receive a patch.

The MiCollab software runs on dedicated, physical Mittel desk phones, and also functions as a softphone on Windows, Mac and mobile systems, giving users the ability to perform web-based collaboration, send and receive faxes, translate voicemails into text, manage documents, and send and receive text messages. The software offers full integration with Microsoft Outlook calendars and Teams, including providing access to the corporate directory and personal contacts.

“While users often think of phone calls as more secure than textual communication, VoIP platforms are juicy targets for APTs, creating the opportunity to listen in on phone calls, interfere with them or block them at will,” watchTowr said. “It’s a very powerful thing to be able to do, and a godsend for an outcome-motivated attacker.”

A patch is available for one of the recently discovered zero-day vulnerabilities in the software – discovered and reported to the vendor by watchTowr – which is tracked as CVE-2024-41713. Mitel on Oct. 9 released MiCollab 9.8 SP2, specifically version 9.8.2.12, that patches the flaw, and as an alternative also released a stand-alone patch that can be applied to versions 9.7 and above of the software.

“A path traversal vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation,” Mitel said. “A successful exploit of this vulnerability could allow an attacker to gain unauthorized access, with potential impacts to the confidentiality, integrity and availability of the system.”

The vulnerability is rated critical, or 9.8 on the CVSS scale, and can be remotely exploited without authentication.

Researchers at watchTowr said that while continuing to test the software, they discovered a second zero day, which is an arbitrary file read vulnerability. The researchers said they notified Mitel about the vulnerability on Aug. 26, and the company told them it plans to release a patch during the first week of December 2024.

As of Thursday, no patch is yet available. Mitel didn’t immediately respond to a request for comment.

Salt Typhoon Warnings

Warnings over the vulnerability in a type of widely used VoIP software arrives as the White House on Wednesday warned that the APT attacks tracked under the banner of “Salt Typhoon,” attributed to China’s foreign intelligence service, have breached at least eight U.S. telecommunications firms’ networks.

Publicly named victims so far are Verizon, AT&T and Lumen. T-Mobile also said the attackers breached its networks but obtained nothing sensitive, including no customer data (see: T-Mobile Hit by Chinese Cyber Spies; Sees Minimal Impact).

Federal officials this week said the attackers are still in U.S. telecommunications networks and have been shifting their tactics in response to public disclosures about the breaches. They offered no timeline for when the attackers might be fully ejected.

The U.S. government has also directly alerted some individuals – believed to include members of the Donald Trump and Kamala Harris presidential campaign teams – that their communications were targeted by the attackers.

In a Wednesday press call, Anne Neuberger, a deputy national security adviser for cyber and emerging technology at the National Security Council, said that the networks of at least five more – as yet not named publicly – U.S. telcos have been breached and sensitive information pertaining to customers stolen, reported NBC News. “There is a risk of ongoing compromises to communications until U.S. companies address the cybersecurity gaps” in their networks, she said, and “the Chinese are likely to maintain their access” until they do so.

Another official told reporters the hackers have stolen an extensive amount of data pertaining to Americans, in their quest to identify high-value targets for more targeted surveillance.

Beyond the U.S., “dozens of countries around the world” have seen their telecommunications networks get breached by the Chinese APT group, Neuberger said.