Mitel Product Security Advisory MISA-2025-0007

Advisory ID: MISA-2025-0007
Publish Date: 2025-06-11
Last Updated: 2025-06-24
Revision: 2.0
 

Summary

A path traversal vulnerability, CVE-2025-52913, in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation.

A successful exploit of this vulnerability could allow an attacker to gain unauthorized access, with potential impacts to the confidentiality, integrity, and availability of the system. If the vulnerability is successfully exploited, an attacker could gain unauthenticated access to provisioning information including non-sensitive user and network information and perform unauthorized administrative actions on the MiCollab Server.

The vulnerability severity is rated as critical. 

Mitel is recommending customers with affected product versions update to the latest release.

Credit is given to Dahmani Toumi, security researcher, for highlighting these issues and bringing these to our attention.

Affected Products and Solutions

This security advisory provides information on the following products: 

Vulnerability Severity

The following products have been identified as affected: 

The vulnerability severity is rated as critical.

Mitigations / Workarounds

Customers with affected product versions should upgrade to the highlighted solution versions or later.

For customers who are not currently able to upgrade to the latest version in a timely manner, Mitel has provided a patch that is available for releases 6.0 and above.

See the KMS article for instructions regarding both the upgrade and the patch.

Solution/ Recommended Action

This issue is corrected in 9.8 SP3 (9.8.3.1) or later releases. Customers are advised to upgrade to this or subsequent releases. 

Please see Mitel Knowledge Base article SO8539, “MiCollab Security Update CVE-2025-52913 Path Traversal Vulnerability” https://mitel.custhelp.com/app/answers/answer_view/a_id/1021759

If you do not have access to this link, please contact your Mitel Authorized Partner for support.

For further information, please contact Mitel Product Support.

Revision History

Publisher and Legal Disclaimer

Publisher: Mitel PSIRT / [email protected]

The information provided in this advisory is provided "as is" without warranty of any kind. The information is subject to change without notice. Mitel and its affiliates do not guarantee and accept no legal liability whatsoever arising from or connected to the accuracy, reliability, currency or completeness of the information provided. No part of this document can be reproduced or transmitted in any form or by any means - electronic or mechanical - for any purpose without written permission from Mitel Networks Corporation.