CVE-2025-30004highCWE-78

CVE-2025-30004: falha de alta gravidade em Xorcom CompletePBX

Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injection

Publicada em · Atualizada em

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.8epss 4.2%
da publicação à arma0 dias
Publicada no NVD31 de mar.
metasploit2 de mar.
probabilidade de exploração
4.2%top 9% das CVEs
exploração observada
nãonenhuma fonte reporta
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Xorcom · CompletePBX
CVEs relacionadas — Xorcom CompletePBX

No mesmo produto, das mais perigosas para as menos.

CVE-2025-30005HIGHXorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File DeletionEPSS 1.8%CVE-2025-2292MEDIUMXorcom CompletePBX <= 5.2.35 Authenticated File DisclosureEPSS 1.8%CVE-2025-30006MEDIUMXorcom CompletePBX <= 5.2.35 Reflected Cross-Site ScriptingEPSS 0.2%
Referências
https://vulncheck.com/advisories/completepbx-authenticated-command-injectionhttps://www.xorcom.com/new-completepbx-release-5-2-36-1/