Shell command injection in Phoniebox
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause a shell command execution. This issue affects Phoniebox in all releases through 2.7. Newer 2.x releases were not tested, but they might also be vulnerable. Phoniebox in version 3.0 and higher are not affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Phoniebox (Phoniebox) Fixed in 3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3799
- 2026-10-03 Alias added: GHSA-98h6-g9rg-hxmr
References
More Phoniebox vulnerabilities
- TI-2024-03544 Insecure handling of GET argument in Phoniebox CVSS 4.0HIGH 8.7
Sources
- CVE-2024-3799 · CVE Program
- CVE-2024-3799 · NVD
- FIRST EPSS
- GHSA-98h6-g9rg-hxmr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences