Subj : Mitel collaboration software zero-day strings along a previously
To   : All
From : TechnologyDaily
Date : Fri Dec 06 2024 16:30:04

Mitel collaboration software zero-day strings along a previously patched 
vulnerability

Date:
Fri, 06 Dec 2024 16:28:00 +0000

Description:
A new flaw has not yet been patched.

FULL STORY
======================================================================Security
 pros from watchTowr found a new bug in Mitel MiCollab Mitel has not yet 
released a patch WatchTowr suggested a number of mitigations to minimize risk 

A zero-day vulnerability, allowing crooks to read files they shouldnt be 
allowed to read, is still sitting in Mitel MiCollab three months after being 
reported. 

This is according to a new report from cybersecurity researchers watchTowr, 
who claim to have found and reported the flaw in late August this year. 

Mitel MiCollab is a unified communications and collaboration solution 
designed to enhance teamwork and productivity by integrating messaging, 
voice, video, and conferencing tools into a single platform. Immediate effect 

The researchers at watchTowr were looking into a different vulnerability when 
they discovered a flaw that allows threat actors to access sensitive 
information about the accounts on a system. They reached out to Mitel, who 
acknowledged the findings and set a deadline for the patch for the first week 
of December, this year. 

At the time of publishing, there has been no update on the Mitel Security 
Advisory page." watchTowr said in a recent report. The researchers also 
released a proof-of-concept, describing how the flaw might be exploited. 

Communication and collaboration platforms are often targeted by 
cybercriminals, as they usually contain sensitive information such as 
contracts, payment information, employee and customer data, and more. 
Criminals can use that information to pressure the victims into paying a 
ransom, or to mount phishing attacks that can result in the deployment of 
ransomware and other malware . 

To make matters worse, BleepingComputer claims that MiCollab was targeted in 
the past as well, suggesting that it is only a matter of time before this new 
zero-day gets exploited, especially with a proof-of-concept already 
available. 

Since the patch is not yet released, users are advised to limit access to the 
MiCollab server, implement stringent firewall rules, monitor logs for 
suspicious activity, and disable (or restrict) access to the ReconcileWIzard 
servlet, if possible. 

 Via BleepingComputer You might also like Apple's zero day threats doubled 
last year  three things IT must do now Here's a list of the best antivirus 
These are the best endpoint protection tools right now



======================================================================
Link to news story:
https://www.techradar.com/pro/security/mitel-collaboration-software-zero-day-s
trings-along-a-previously-patched-vulnerability


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.