CVE-2024-0986
Published: 29 January 2024
Summary
CVE-2024-0986 is a medium-severity OS Command Injection (CWE-78) vulnerability in Issabel Pbx. Its CVSS base score is 4.7 (Medium).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-0986 is an OS command injection vulnerability in Issabel PBX version 4.0.0 that resides in the Asterisk-Cli component. Untrusted input passed through the Command argument to the script at /index.php?menu=asterisk_cli is executed directly by the underlying operating system, corresponding to CWE-78.
An attacker with administrative credentials can supply a crafted Command value over the network to achieve limited control over confidentiality, integrity, and availability on the affected system. The attack does not require user interaction and the public exploit code enables remote execution once valid credentials are obtained.
Public references, including VulDB and a technical write-up from vicarius, contain no vendor-supplied patches or mitigation guidance; the Issabel maintainers were notified prior to disclosure but did not respond.
The EPSS score rose from a low baseline to a peak of 0.9441 with a current value of 0.8063, indicating that exploitation interest increased substantially after the vulnerability was published.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16763
Vulnerability details
A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The…
more
attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252251. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.