CVE-2025-30004

Description

Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35

Reserved 2025-03-13 | Published 2025-03-31 | Updated 2025-03-31 | Assigner VulnCheck

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
affected

Any version
affected

Credits

Valentin Lobstein (Chocapikk) finder

References

vulncheck.com/...completepbx-authenticated-command-injection third-party-advisory

www.xorcom.com/new-completepbx-release-5-2-36-1/ vendor-advisory

cve.org (CVE-2025-30004)

nvd.nist.gov (CVE-2025-30004)

Download JSON