CVE-2007-6424

registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS spoofing attack.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

2.47% chance of exploitation in the next 30 days, 83th percentile

Published

2007-12-18

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002528.html

References

• CVE Record
• NVD entry

Related

• CVE-2007-6414
• CVE-2007-6453
• CVE-2007-6405
• CVE-2007-6454
• CVE-2007-6404
• CVE-2007-6455