Mitel - CraftedSignal Threat Feed

Multiple Vulnerabilities in Mitel Products Allow Remote Code Execution and XSS

hello@craftedsignal.io — Thu, 23 Jul 2026 11:54:26 +0000

The French National Agency for the Security of Information Systems (ANSSI) has published an advisory regarding multiple critical vulnerabilities discovered in Mitel's MiCollab and Openscape UC products. These security flaws allow a remote attacker to achieve arbitrary code execution (RCE) and perform indirect remote code injection, commonly known as Cross-Site Scripting (XSS). The affected versions include MiCollab versions 10.2.x prior to 10.2 SP1 FP2 (10.2.1.205), versions 10.3.x prior to 10.3.0.18, and versions prior to 9.8 SP3 FP2 (9.8.3.203). Openscape UC versions V10 prior to V10 R6 FR18 and V11 prior to V11 R1 FR2 are also impacted. These vulnerabilities pose a severe risk to organizations using the affected communications platforms, potentially leading to full system compromise or client-side attacks against users.

Attack Chain

Reconnaissance & Vulnerability Identification: An attacker identifies publicly exposed and unpatched Mitel MiCollab or Openscape UC servers within a target organization's network perimeter.
Initial Exploitation (RCE): The attacker crafts and sends a specially malformed HTTP request or input payload designed to trigger an arbitrary code execution vulnerability on the vulnerable server.
Initial Exploitation (XSS): Alternatively or in parallel, the attacker exploits an indirect remote code injection (XSS) vulnerability by injecting malicious client-side script into a data field or application response.
Arbitrary Code Execution: The vulnerable Mitel server processes the malicious input, leading to the execution of attacker-controlled code with the privileges of the affected service or system.
Client-Side Script Execution: If the XSS vulnerability is successfully exploited, the injected script executes within the web browser of any legitimate user who subsequently accesses the compromised application.
Impact (RCE): Successful RCE provides the attacker with unauthorized control over the affected Mitel server, enabling actions such as deploying malware, establishing persistence, exfiltrating sensitive data, or pivoting to other systems.
Impact (XSS): Successful XSS allows the attacker to compromise user sessions, steal credentials, deface web content, or perform other client-side malicious actions, affecting users interacting with the vulnerable application.

Impact

The successful exploitation of these vulnerabilities can lead to severe consequences for organizations utilizing the affected Mitel products. Remote Code Execution allows attackers to gain complete control over the compromised server, potentially leading to unauthorized access to sensitive data, system disruption, installation of backdoors, or the deployment of ransomware. Cross-Site Scripting (XSS) attacks can compromise user accounts, steal session cookies, deface websites, or launch phishing attacks against users interacting with the vulnerable application. Organizations in various sectors relying on these communication platforms for their daily operations are at risk of significant operational disruption and data breaches.

Recommendation

Refer to the Mitel security advisories and promptly apply the recommended patches to all affected MiCollab and Openscape UC instances.
Block network connections to indicators of compromise from the iocs table at the network perimeter.
Regularly review web server logs for unusual requests or patterns associated with RCE or XSS exploitation attempts, including webserver category logs for unusual cs-uri-stem or cs-uri-query values.

Mitel MiCollab Vulnerability Allows Remote Code Execution

hello@craftedsignal.io — Thu, 23 Jul 2026 10:30:50 +0000

A critical remote code execution (RCE) vulnerability has been identified in Mitel MiCollab, allowing a remote, unauthenticated attacker to execute arbitrary program code on affected systems. This flaw, highlighted by CERT-Bund, presents a significant risk as it can be exploited without prior authentication, enabling complete system compromise. The vulnerability affects Mitel MiCollab, a unified communications and collaboration platform widely used in enterprise environments. Successful exploitation could lead to full control over the compromised server, allowing attackers to access sensitive data, deploy further malicious payloads such as ransomware, or pivot to other systems within the network. Organizations utilizing Mitel MiCollab should prioritize patching to mitigate the severe threat posed by this unauthenticated RCE.

Attack Chain

An unauthenticated attacker performs reconnaissance to identify an internet-exposed Mitel MiCollab server.
The attacker crafts a malicious payload designed to execute arbitrary code on the target system.
The attacker sends a specially prepared request, embedding the malicious payload, to the vulnerable Mitel MiCollab application.
The MiCollab application processes the request, triggering the vulnerability and executing the attacker's code with the application's privileges.
The executed code provides the attacker with an initial foothold on the server, potentially by establishing a reverse shell or creating a new user account.
The attacker may then attempt to escalate privileges on the compromised system if the initial code execution is not at the highest privilege level.
Post-exploitation activities commence, which may include installing additional malware, exfiltrating data, or establishing persistence mechanisms.
The attacker achieves their final objective, such as complete system compromise, data theft, or further lateral movement within the victim's network.

Impact

Successful exploitation of this critical vulnerability in Mitel MiCollab would grant an unauthenticated, remote attacker arbitrary code execution privileges on the affected server. This could lead to a full system compromise, allowing adversaries to install backdoors, exfiltrate sensitive data, deploy ransomware, or establish persistence within the victim's network. Organizations, particularly those in sectors relying heavily on unified communications, face a high risk of significant disruption, data breaches, and reputational damage if this flaw is left unaddressed.

Recommendation

Apply vendor patches for Mitel MiCollab immediately to address this critical remote code execution vulnerability.

Mitel OpenScape Cross-Site Scripting Vulnerability

hello@craftedsignal.io — Thu, 23 Jul 2026 10:26:38 +0000

A Cross-Site Scripting (XSS) vulnerability has been identified in Mitel OpenScape, allowing a remote, authenticated attacker to execute malicious scripts within the context of a victim's browser. This flaw, recently disclosed, grants the attacker the ability to bypass client-side security mechanisms and inject arbitrary code. Successful exploitation could lead to various impacts, including session hijacking, unauthorized access to sensitive user data, defacement of web content, or redirection to malicious external websites. The threat actor requires prior authentication to leverage this vulnerability, indicating that compromised user credentials or social engineering tactics to obtain them would precede the XSS attack. This vulnerability poses a significant risk to the integrity and confidentiality of user interactions within the affected Mitel OpenScape environment.

Attack Chain

Initial Access (Authentication): An attacker obtains valid credentials for a Mitel OpenScape user account through various means, such as phishing, credential stuffing, or brute-force attacks.
Vulnerability Identification/Exploitation: The authenticated attacker identifies a user input field, parameter, or component within the Mitel OpenScape application that is vulnerable to Cross-Site Scripting (XSS).
Payload Injection: The attacker crafts and injects a malicious script payload (e.g., JavaScript code) into the vulnerable input field, often disguised within legitimate data or URL parameters.
Persistence/Delivery Mechanism: The injected script is either stored persistently by the application (stored XSS), reflected back in a response to another user (reflected XSS), or delivered via a crafted link to a potential victim.
Victim Interaction: A legitimate user, typically with access to sensitive data or higher privileges, accesses the specific vulnerable application component where the malicious script resides or is reflected.
Client-Side Execution: The victim's web browser renders the affected page, leading to the execution of the injected malicious JavaScript code within the security context of the Mitel OpenScape application.
Impact on Victim: The executed script performs malicious actions, such as stealing the victim's session cookies, manipulating the displayed content, redirecting the victim to a phishing site, or initiating unauthorized actions on behalf of the victim.
Data Exfiltration/Further Compromise: Stolen session tokens, credentials, or other sensitive data are exfiltrated to an attacker-controlled server, enabling session hijacking, unauthorized account access, or potential lateral movement within the victim's network.

Impact

Successful exploitation of this XSS vulnerability by an authenticated attacker can result in significant compromise of user accounts and data within Mitel OpenScape. Victims may have their session cookies stolen, leading to session hijacking and complete takeover of their accounts without needing their passwords. This can facilitate unauthorized access to sensitive communications, contact lists, and other proprietary information managed by the platform. Attackers could also redirect users to phishing sites, perform arbitrary actions on behalf of the victim, or deface the legitimate application interface, eroding trust and potentially spreading malware. While no specific victim numbers are provided, any organization utilizing Mitel OpenScape with this unpatched vulnerability is at risk.

Recommendation

Apply the latest security patches and updates released by Mitel for OpenScape immediately to address the identified XSS vulnerability.
Implement web application firewall (WAF) rules to detect and block common XSS payloads in HTTP requests to Mitel OpenScape servers.
Deploy the Sigma rule "Detect Potential Cross-Site Scripting Attempts in Web Logs" to your SIEM and configure it to alert on suspicious patterns in cs-uri-query and cs-uri-stem fields from web server logs.
Enable comprehensive web server logging to capture full HTTP request details, including method, URI, query parameters, and user-agent, to aid in forensic analysis and detection.