Fonality Trixbox CE Post-Authentication Command Injection
Priority HIGH 74CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.
Why it matters now
EPSS 0.65208 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Trixbox Community Edition (Fonality): 1.0, 1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fonality | Trixbox Community Edition | 2.8.0.4 – 2.8.0.4 | 1.0, 1.1 | Patch available | CNA |
- Trixbox Community Edition VendorFonality Affected 2.8.0.4 – 2.8.0.4 Fixed in 1.0, 1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netfortris:trixbox:*:*:*:*:community:*:*:* | 1.2.0 – 2.8.0.4 | Vulnerable | Netfortris |
- cpe:2.3:a:netfortris:trixbox:*:*:*:*:community:*:*:* Versions 1.2.0 – 2.8.0.4 Vulnerable ·Netfortris
Remediation
- Fix · CNA Trixbox Community Edition (Fonality) Fixed in 1.0, 1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7351
- 2026-10-03 Alias added: GHSA-fp83-q3j6-rggc
References
More Fonality vulnerabilities
- TI-2016-02123 Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded… CVSS 3.0CRITICAL 9.8
- TI-2016-02125 The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6… CVSS 3.0HIGH 7.5
- TI-2016-02124 Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak… CVSS 3.0HIGH 7.8
Sources
- CVE-2020-7351 · CVE Program
- CVE-2020-7351 · NVD
- FIRST EPSS
- GHSA-fp83-q3j6-rggc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences