Filtered by vendor 3cx Subscriptions
Filtered by product Phone System Firmware Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-9971 2 3cx, Debian 3 Phone System, Phone System Firmware, Debian Linux 2022-06-14 8.8 High
PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump command, without a password. This occurs because the -z (aka postrotate-command) option to tcpdump can be unsafe when used in conjunction with sudo.
CVE-2019-9972 2 3cx, Debian 3 Phone System, Phone System Firmware, Debian Linux 2022-06-14 8.8 High
PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of "<space><space> followed by <shift><enter>" mishandling.