{"id":"CVE-2020-7351","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-7351","generatedAt":"2026-11-05T02:08:53.043Z","title":"An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the \"asterisk\" user.","description":"An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the \"asterisk\" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.","published":"2020-05-01T16:15:13.000Z","lastModified":"2026-06-17T03:24:45.000Z","status":"Modified","sourceIdentifier":"cve@rapid7.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-78"],"affected":["netfortris/trixbox"],"epss":{"score":0.65208,"percentile":0.99255,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 65.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html","tags":["Exploit","Third Party Advisory"],"source":"cve@rapid7.com"},{"url":"https://github.com/rapid7/metasploit-framework/pull/13353","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"],"source":"cve@rapid7.com"},{"url":"http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rapid7/metasploit-framework/pull/13353","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-7351","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}