[0day-rubbish] VitalPBX 4.5.2 (Asterisk 20.20.1) Authenticated root RCE via asterisk_cli to dialplan System() (8.8)

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-08-26 15:28 UTC
  • Importiert: 2026-08-26 17:02 UTC
  • Quelle-ID: full_disc
  • uid_hash: 77fe98a184b0fd1f546e108182b9bb77e35e5b31a8b7655432a920dfe7be64dc
Full Disclosure

Inhalt

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in VitalPBX 4.5.2 (Asterisk 20.20.1).

Type: Authenticated root RCE via asterisk_cli to dialplan System() (CWE-78)

CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

Impact: Authenticated escalation from web administrator to root shell on the PBX host, exposing call recordings, SIP

credentials, and CDRs.

Authentication: authenticated (requires valid session)

Full technical...

No data

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
Full Disclosure

full_disc

 threat_intel - de https://seclists.org/rss/fulldisclosure.rss
Zurueck zur Eintrags-Liste