- Security pros from watchTowr found a new bug in Mitel MiCollab
- Mitel has not yet released a patch
- WatchTowr suggested a number of mitigations to minimize risk
A zero-day vulnerability, allowing crooks to read files they shouldn’t be allowed to read, is still sitting in Mitel MiCollab three months after being reported.
This is according to a new report from cybersecurity researchers watchTowr, who claim to have found and reported the flaw in late August this year.
Mitel MiCollab is a unified communications and collaboration solution designed to enhance teamwork and productivity by integrating messaging, voice, video, and conferencing tools into a single platform.
The researchers at watchTowr were looking into a different vulnerability when they discovered a flaw that allows threat actors to access sensitive information about the accounts on a system. They reached out to Mitel, who acknowledged the findings and set a deadline for the patch for the first week of December, this year.
“At the time of publishing, there has been no update on the Mitel Security Advisory page.” watchTowr said in a recent report. The researchers also released a proof-of-concept, describing how the flaw might be exploited.
Communication and collaboration platforms are often targeted by cybercriminals, as they usually contain sensitive information such as contracts, payment information, employee and customer data, and more. Criminals can use that information to pressure the victims into paying a ransom, or to mount phishing attacks that can result in the deployment of ransomware and other malware.
To make matters worse, BleepingComputer claims that MiCollab was targeted in the past as well, suggesting that it is only a matter of time before this new zero-day gets exploited, especially with a proof-of-concept already available.
Since the patch is not yet released, users are advised to limit access to the MiCollab server, implement stringent firewall rules, monitor logs for suspicious activity, and disable (or restrict) access to the ReconcileWIzard servlet, if possible.
Via BleepingComputer