The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three significant vulnerabilities impacting Mitel MiCollab and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog. These flaws, now under active exploitation, have raised alarms across the cybersecurity landscape due to their potential to enable unauthorized access and malicious activities.

The Vulnerabilities in Focus

Three vulnerabilities have been spotlighted for their criticality:

CVE-2024-41713 (CVSS score: 9.1): This path traversal flaw in Mitel MiCollab allows attackers to gain unauthorized and unauthenticated access to the system.
CVE-2024-55550 (CVSS score: 4.4): Another path traversal issue in Mitel MiCollab, enabling authenticated users with administrative privileges to read local files, owing to insufficient input sanitization.
CVE-2020-2883 (CVSS score: 9.8): A severe security vulnerability in Oracle WebLogic Server exploitable by unauthenticated attackers with network access via IIOP or T3.

The vulnerabilities carry differing levels of severity, but the potential to chain CVE-2024-41713 with CVE-2024-55550 has heightened concerns. This combination could enable remote, unauthenticated attackers to read arbitrary files, amplifying the risks associated with Mitel MiCollab systems.

What Do We Know About Exploitation?

While technical details on real-world exploitation remain scarce, insights from WatchTowr Labs have shed some light on the vulnerabilities in Mitel MiCollab.

In their investigative efforts to replicate another critical flaw (CVE-2024-35286, CVSS score: 9.8) patched in May 2024, researchers identified the twin vulnerabilities. The findings suggest these flaws could be leveraged to compromise sensitive data and possibly disrupt communications infrastructure.

Oracle’s CVE-2020-2883, on the other hand, has a history of active exploitation attempts. Back in April 2020, Oracle warned that malicious actors had been targeting this vulnerability soon after its discovery, highlighting the urgency of patching.

Yet, the absence of information about specific targets or attack methods underscores the need for vigilance. Organizations relying on these platforms must prioritize mitigations to stay ahead of potential threats.

CISA’s Mandate and Timeline

In accordance with Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies have been instructed to apply necessary updates by January 28, 2025.

This directive aims to secure government networks and prevent attackers from exploiting known vulnerabilities. The urgency stems from the vulnerabilities’ high CVSS scores, reflecting their ease of exploitation and potential impact.

Key highlights of BOD 22-01:

Mandates timely remediation of vulnerabilities listed in the KEV catalog.
Focuses on improving cyber hygiene across federal networks.
Holds agencies accountable for adhering to patching deadlines.

The directive is a clear call to action, emphasizing proactive measures to strengthen security.

Broader Implications and Next Steps

These vulnerabilities serve as a reminder of the ongoing battle between attackers and defenders. As exploitation methods evolve, the responsibility to adapt lies not just with federal agencies but also with private organizations that depend on these systems.

For Mitel MiCollab users:

Ensure systems are updated to address CVE-2024-41713 and CVE-2024-55550.
Monitor for patches addressing related flaws, such as CVE-2024-35286.

For Oracle WebLogic users:

Validate that CVE-2020-2883 has been patched in your environment.
Regularly audit and test your security posture to identify any overlooked risks.

Ultimately, while CISA’s efforts provide essential guidance, the responsibility to act lies with organizations themselves. Ignoring these vulnerabilities could leave critical infrastructure exposed to potentially devastating consequences.