CVE-2025-30004
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35
Analysis
Xorcom CompletePBX through version 5.2.35 contains an authenticated command injection vulnerability in the Task Scheduler functionality. Attackers with administrator access can inject arbitrary OS commands that execute as root, achieving complete system compromise of the VoIP PBX.
Technical Context
The Task Scheduler in CompletePBX's admin interface allows scheduling system tasks. The task definition parameters are passed to the system shell without proper sanitization, enabling command injection. Since the PBX daemon runs as root, injected commands execute with root privileges. Administrator authentication is required but default credentials are common on PBX systems.
Affected Products
['Xorcom CompletePBX <= 5.2.35']
Remediation
Update to CompletePBX beyond 5.2.35. Change all default credentials. Restrict admin interface access to management VLANs. Monitor scheduled tasks for unauthorized entries. Implement SIP trunk security controls to prevent toll fraud.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today