Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2025-52913 EUVD-2025-24008GHSA-x9rw-437p-f3p6

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticate…

Published Aug 8, 2025 · Updated Feb 26, 2026 · Assigned by mitre

Description

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • pgaSUS99/PoC-CVE-2025-52913 ★ 0 · Mar 26, 2026

    A Proof of Concept (PoC) for CVE-2025-52913, a path normalization vulnerability affecting Mitel MiCollab.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References