The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding critical vulnerabilities in Oracle WebLogic Server and Mitel MiCollab systems that are currently being exploited in cyberattacks. This advisory, released on January 7, 2025, highlights the necessity for U.S. federal agencies to secure their systems against these threats.
Key vulnerabilities identified
CISA has specifically identified a critical path traversal vulnerability in Mitel’s MiCollab unified communications platform, tracked as CVE-2024-41713. This flaw resides in the NuPoint Unified Messaging (NPM) component and allows attackers to perform unauthorized administrative actions, potentially compromising user and network information. Notably, this vulnerability can be exploited without authentication, meaning that attackers can gain access without needing valid credentials. Mitel warns that if exploited, this vulnerability could severely impact the confidentiality, integrity, and availability of affected systems.In addition to CVE-2024-41713, CISA has flagged another vulnerability in the Mitel MiCollab system, CVE-2024-55550, which allows authenticated attackers with administrative privileges to read arbitrary files on vulnerable servers. While this exploitation does not permit privilege escalation, it still poses a risk as it could expose non-sensitive system information.
Furthermore, CISA has reiterated concerns over a previously patched Oracle WebLogic Server flaw, CVE-2020-2883, which enables unauthenticated attackers to remotely compromise unpatched servers. Although this vulnerability was addressed in April 2020, its continued exploitation underscores the importance of timely updates and patches.
Urgent Action Required
CISA has added all three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing their active exploitation in the wild. As per the Binding Operational Directive (BOD) 22-01 issued in November 2021, Federal Civilian Executive Branch agencies are required to secure their networks against these vulnerabilities within three weeks—by January 28, 2025.CISA stresses that these types of vulnerabilities are common attack vectors for malicious actors and represent significant risks to federal enterprises. While the immediate focus is on federal agencies, CISA advises all organizations to prioritize mitigating these security flaws to prevent ongoing attacks.