Command injection

2022-06-0718:15:00

PRIOn knowledge base

www.prio-n.com

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.5%

JSON

PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of “<space><space> followed by <shift><enter>” mishandling.

CPENameOperatorVersion
phone_system_firmwareeq16.0.0.1570

CPE	Name	Operator	Version
	phone_system_firmware	eq	16.0.0.1570

References

www.gosecure.net/blog

www.gosecure.net/blog/2022/05/31/security-advisory-multiple-vulnerabilities-impact-3cx-phone-system/