CVE-2019-9972 PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of "<space><spa...
HighCVSS 8.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of "<space><space> followed by <shift><enter>" mishandling.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 3cx phone system firmware | = 16.0.0.1570 | No fix listed |
| debian linux | All versions | No fix listed |
References
- www.gosecure.net third-party-advisory
- www.gosecure.net exploit third-party-advisory