Mitel and Oracle Systems Flaws Under Active Exploitation, CISA Warns

• The U.S. CISA has evidence three new critical flaws in Mitel and Oracle systems are actively exploited.
• Two of these are critical path traversal vulnerabilities in Mitel MiCollab, one of which could allow remote unauthenticated access to an attacker.
• CISA also warns that unauthenticated attackers with network access via IIOP or T3 protocols could exploit an Oracle WebLogic Server flaw.

Three new vulnerabilities affecting Mitel MiCollab and Oracle WebLogic Server were flagged as being under active exploitation: CVE-2024-41713 (CVSS score: 9.1), CVE-2024-55550 (CVSS score: 4.4), and CVE-2020-2883 (CVSS score: 9.8).

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday.

CVE-2024-41713 is a critical path traversal vulnerability in Mitel MiCollab that could allow a remote, unauthenticated attacker to gain unauthorized access, while CVE-2024-55550 is a path traversal vulnerability in Mitel MiCollab affecting authenticated administrators, enabling them to read local files on the system due to lack of input sanitization.  

These two CVEs can be chained to enable unauthenticated, remote attackers to read arbitrary files on compromised servers, amplifying the risks associated with these vulnerabilities. 

CVE-2020-2883 is a vulnerability in Oracle WebLogic Server that can be exploited by an unauthenticated attacker with network access via IIOP or T3 protocols.

WatchTowr Labs first reported on these issues last month as part of their research associated with another critical Mitel MiCollab bug (CVE-2024-35286, CVSS score 9.8), which Mitel patched in May 2024.

Regarding the Oracle WebLogic Server security vulnerability, Oracle issued warnings as early as April 2020 about malicious attempts to exploit CVE-2020-2883—shortly after its patch release. IIOP and T3’s network access requirements offer cybercriminals a broad attack surface, with potentially severe consequences for unpatched systems.

Under Binding Operational Directive 22-01, Federal Civilian Executive Branch (FCEB) agencies must apply patches for these vulnerabilities by January 28, 2025, to mitigate risk and protect against potential attacks. 

No specific information is yet available on active exploitation details, such as attacker profiles or targeted systems.

Last year, hackers targeted Oracle Weblogic Server flaws for crypto mining in two cases: one by the 8220 Gang and the other involving a Linux-based malware known as Hadooken.