VULNERABILITY INTELLIGENCE

CVE-2020-7351

CVSS score7.3 HIGH

EPSS probability65.21%

CISA KEVNot currently listed

Published2020-05-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Description

An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.

Weakness classification

cve@rapid7.com: CWE-78
nvd@nist.gov: CWE-78

Primary references

cve@rapid7.com — Exploit, Third Party Advisory
cve@rapid7.com — Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Patch, Third Party Advisory