CVE-2019-9972

PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of "<space><space> followed by <shift><enter>" mishandling.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2022-06-07

Last modified

2024-08-04

Weaknesses

CWE-77

Affected products

• Phone System Firmware (3cx)
• Debian Linux (Debian)

References

• https://www.gosecure.net/blog
• https://www.gosecure.net/blog/2022/05/31/security-advisory-multiple-vulnerabilities-impact-3cx-phone-system/