Vulnerability Details : CVE-2007-6424
Potential exploit
registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS spoofing attack.
Products affected by CVE-2007-6424
- cpe:2.3:a:netfortris:trixbox:2.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2007-6424
0.52%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 65 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-6424
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2007-6424
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-6424
-
http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002528.html
-
http://voipsa.org/blog/2007/12/17/trixbox-contains-phone-home-code-to-retrieve-arbitrary-commands-to-execute/
-
http://www.superunknown.org/pivot/entry.php?id=15
Exploit
-
http://www.trixbox.org/forums/trixbox-forums/open-discussion/trixbox-phones-home
-
http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002533.html
-
http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002522.html
Jump to