PoC exploit chains Mitel MiCollab 0-day, auth-bypass bug to access sensitive files

A watchTowr disclosure and published proof-of-concept detail three security issues in Mitel MiCollab — a fixed critical SQL injection (CVE-2024-35286), a fixed authentication bypass (CVE-2024-41713), and an unpatched post-auth arbitrary file-read zero-day that can be chained with the auth bypass to expose sensitive files (e.g., /etc/passwd); Mitel later published advisories and partial mitigations but the zero-day remained without a dedicated CVE or immediate patch at the time of reporting.