PT-2021-9166 · Sangoma · Sangoma Freepbx+1

Published 2021-05-31 · Updated 2022-07-12 · CVE-2020-10666

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sangoma FreePBX and PBXact versions 13 through 15.0.19.2

Description The issue allows remote code execution via a URL variable to an AMI command. This is related to the restapps module, also known as Rest Phone apps.

Recommendations For versions 13 through 15.0.19.2, consider restricting access to the restapps module to minimize the risk of exploitation. As a temporary workaround, avoid using URL variables that could lead to AMI commands until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-10666

Affected Products

Pbxact

Sangoma Freepbx

References · 5

• https://osv.dev/vulnerability/CVE-2020-10666 · Vendor Advisory
• https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10666 · Security Note
• https://wiki.freepbx.org/display/FOP/2020-03-12+SECURITY%3A+Potential+Rest+Phone+Apps+RCE · Vendor Advisory
• https://t.me/cvenotify/15297 · Telegram Post