CVE-2024-0986

Issabel PBX Asterisk-Cli os command injection

CVSS 4.7 MEDIUMEPSS 58.4%CWE-78

Vexday Risk Score

40Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 4.7EPSS 58.4%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

28 Jan 2024Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252251. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Affected products

Issabel · PBX

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://drive.google.com/file/d/10BYLQ7Rk4oag96afLZouSvDDPvsO7SoJ/view?usp=drive_link https://vuldb.com/?ctiid.252251 https://vuldb.com/?id.252251 https://www.vicarius.io/vsociety/posts/issabel-authenticated-remote-code-execution-cve-2024-0986