Vulnerability identifier: #VU5362
Vulnerability risk: Critical
CVSSv3.1: 9.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-94
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
FreePBX
Server applications /
Conferencing, Collaboration and VoIP solutions
Vendor: FreePBX
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to an error in the legacy FreePBX ARI Framework module/Asterisk Recording Interface (ARI). A remote attacker can bypass the authentication process and execute arbitrary code with administrative privileges.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: this vulnerability was being actively exploited.
Mitigation
Update to version 2.12.0.5 or later.
Vulnerable software versions
FreePBX: 2.9.0.8 - 2.11.1.4
External links
http://community.freepbx.org/t/critical-freepbx-rce-vulnerability-all-versions-cve-2014-7235/24536
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.