CVE-2020-7351: Fonality Trixbox CE Post-Authentication Command Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 65.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-05-01 · updated 2026-06-17
Weakness: CWE-78

Description

An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.

Affected products

Fonality Trixbox Community Edition: from 1.2.0 through 2.8.0.4

References

http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html
https://github.com/rapid7/metasploit-framework/pull/13353
http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html
https://github.com/rapid7/metasploit-framework/pull/13353

Get alerted when CVE-2020-7351 or the next vulnerability affects your stack