CRITICAL🇵🇱 Wersja polska

CVE-2021-45966

CVSS 9.8v3.1pub. 2022-03-18upd. 2024-11-21

An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pascom Cloud Phone System
APP
Pascom
≤ 7.19

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

Tags

RCECommand Injection

CWE

CWE-78

References

kerbit.io/research/read/blog/4…

tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-…

www.pascom.net/doc/en/release-notes/…

kerbit.io/research/read/blog/4…

tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-…

www.pascom.net/doc/en/release-notes/…

Related vulnerabilities

CVE-2021-45967CRITICAL9.8ten sam produkt

An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a ...

CVE-2021-45968HIGH7.5ten sam produkt

An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom...