CVE-2007-6424 registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the co...
MediumCVSS 4.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS spoofing attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netfortris trixbox | = 2.0 | No fix listed |
References
- 44136 vdb-entry
- voipsa.org
- [VOIPSEC] 20071216 Trixbox Arbitrary Command Execution Vulnerability mailing-list
- [VOIPSEC] 20071219 trixbox vuln (CVE-2007-6424) - PoC exploit code mailing-list
- [VOIPSEC] 20071219 trixbox vulnerability fluff mailing-list
- www.superunknown.org exploit url-repurposed
- www.trixbox.org