CVE-2024-47224: Mitel MiCollab · Improper Encoding or Escaping of Output
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- Mitel MiCollab through 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 21 Oct 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Organizations should prioritize monitoring Mitel’s official channels for patches addressing this vulnerability and apply them promptly once available. In the interim, implement strict input validation and output encoding on all URL parameters processed by the AWV component to prevent CRLF injection. Employ web application firewalls (WAFs) with rules designed to detect and block CRLF injection attempts targeting HTTP headers. Educate users to be cautious of unexpected links in communications, especially those related to conferencing invitations or messages. Conduct phishing awareness training emphasizing this specific attack vector. Restrict exposure of the affected MiCollab components to trusted networks only, using network segmentation and access controls. Regularly audit logs for suspicious HTTP header anomalies or unusual redirect patterns. Consider deploying endpoint protection solutions capable of detecting phishing payloads and malicious web content. Finally, maintain an incident response plan tailored to phishing and web-based attacks to quickly contain potential exploitation.
Description
A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perform a phishing attack.