CVE-2026-104811

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

CVE-2026-104811 Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

CVE-2026-104811 Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

EUVD-2026-92305

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

CVE-2026-104811

The Mitel MiVoice Office 400 is vulnerable to remote code execution due to an improper file type validation flaw in the Music on Hold functionality. Located in the web portal on TCP port 443 (Configuration → Services), the application fails to properly restrict uploaded files to the intended WAV ...

PT-2026-104776

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

CVE-2026-104811: Unrestricted Upload of File with Dangerous Type

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

CVE-2026-45562

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

EUVD-2026-88385

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562

The FreePBX Music on Hold (MoH) module is vulnerable to Authenticated Remote Code Execution in versions prior to 16.0.4 and 17.0.6 . The root cause is a lack of sanitization for a POST parameter that defines a custom Asterisk application . This unsanitized data is stored in the database and subse...

PT-2026-99957

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-73662

A flaw was found in the FreePBX Music on Hold module. An authenticated administrator can exploit dangerous command-line options when configuring media players, such as /usr/bin/mpg123. This allows the administrator to execute arbitrary commands as the asterisk service user by writing files, openi...

CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73662 Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73662 Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

EUVD-2026-58485

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...