Completepbx
CVE-2025-30004
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user.
This issue affects CompletePBX: all versions up to and prior to 5.2.35
AnalysisAI
Xorcom CompletePBX through version 5.2.35 contains an authenticated command injection vulnerability in the Task Scheduler functionality. Attackers with administrator access can inject arbitrary OS commands that execute as root, achieving complete system compromise of the VoIP PBX.
Technical ContextAI
The Task Scheduler in CompletePBX's admin interface allows scheduling system tasks. The task definition parameters are passed to the system shell without proper sanitization, enabling command injection. Since the PBX daemon runs as root, injected commands execute with root privileges. Administrator authentication is required but default credentials are common on PBX systems.
RemediationAI
Update to CompletePBX beyond 5.2.35. Change all default credentials. Restrict admin interface access to management VLANs. Monitor scheduled tasks for unauthorized entries. Implement SIP trunk security controls to prevent toll fraud.
Share
External POC / Exploit Code
Leaving vuln.today