CVE-2020-7351 describes an OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition, affecting versions 1.2.0 through 2.8.0.4. This flaw allows an authenticated attacker to execute arbitrary commands on the underlying operating system with the privileges of the "asterisk" user. With a CVSS score of 8.8 (High), this vulnerability presents a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While Trixbox Community Edition is an unsupported product, a Metasploit module exists for this vulnerability, indicating readily available exploit code. Despite this, there is no evidence of active exploitation, and community discussion and media coverage remain minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.2.0, <= 2.8.0.4CPE matchmatch criteria | cpe:2.3:a:netfortris:trixbox:*:*:*:*:community:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.