Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses

News

Researchers have disclosed three security vulnerabilities affecting Pascom Cloud Phone System (CPS) that could be combined to achieve a full pre-authenticated remote code execution of affected systems.

Kerbit security researcher Daniel Eshetu said the shortcomings, when chained together, can lead to “an unauthenticated attacker gaining root on these devices.”

Pascom Cloud Phone System is an integrated collaboration and communication solution that allows businesses to host and set up private telephone networks across different platforms as well as facilitate the monitoring, maintenance, and updates associated with the virtual phone systems.

Automatic GitHub Backups

The set of three flaws includes those stemming from an arbitrary path traversal in the web interface, a server-side request forgery (SSRF) due to an outdated third-party dependency (CVE-2019-18394), and a post-authentication command injection using a daemon service (“exd.pl”).

In other words, the vulnerabilities can be stringed in a chain-like fashion to access non-exposed endpoints by sending arbitrary GET requests to obtain the administrator password, and then use it to gain remote code execution using the scheduled task.

Prevent Data Breaches

The exploit chain can be used “to execute commands as root,” Eshetu said, adding, “this gives us full control of the machine and an easy way to escalate privileges.” The flaws were reported to Pascom on January 3, 2022, following which patches have been released.

Customers who are self-hosting CPS as opposed to on the cloud are advised to update to the latest version (pascom Server 19.21) as soon as possible to counter any potential threats.

Products You May Like

Articles You May Like

Interested in cybersecurity? Join us for Security SOS Week 2022!
Hackers Exploited Zero-Day RCE Vulnerability in Sophos Firewall — Patch Released
Russian Sandworm Hackers Impersonate Ukrainian Telecoms to Distribute Malware
Rising to the challenges of secure coding – Week in security with Tony Anscombe
Air Force Upgrades Digital Modernization Strategy to “As a Service” Model

Leave a Reply

Your email address will not be published.