Xorcom CompletePBX Command Injection Vulnerability in Task Scheduler
Vulnerability
A command injection vulnerability has been identified in Xorcom CompletePBX, specifically within the Task Scheduler feature for administrators. This vulnerability allows attackers to execute arbitrary commands with root privileges. It affects all CompletePBX versions prior to 5.2.35.
Impact
Exploitation of this vulnerability allows for unauthorized command execution as the root user, potentially leading to full system compromise.
Remediation
Users are advised to upgrade to Xorcom CompletePBX version 5.2.36.1 or later. Instructions for upgrading are available on the Xorcom website.
Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
7.5exploitability
4.8remediation
7.7relevance
0.0threat
1.4urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.