Security News > 2022 > March > Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses
Researchers have disclosed three security vulnerabilities affecting Pascom Cloud Phone System that could be combined to achieve a full pre-authenticated remote code execution of affected systems.
Kerbit security researcher Daniel Eshetu said the shortcomings, when chained together, can lead to "An unauthenticated attacker gaining root on these devices."
Pascom Cloud Phone System is an integrated collaboration and communication solution that allows businesses to host and set up private telephone networks across different platforms as well as facilitate the monitoring, maintenance, and updates associated with the virtual phone systems.
In other words, the vulnerabilities can be stringed in a chain-like fashion to access non-exposed endpoints by sending arbitrary GET requests to obtain the administrator password, and then use it to gain remote code execution using the scheduled task.
The exploit chain can be used "To execute commands as root," Eshetu said, adding, "This gives us full control of the machine and an easy way to escalate privileges." The flaws were reported to Pascom on January 3, 2022, following which patches have been released.
Customers who are self-hosting CPS as opposed to on the cloud are advised to update to the latest version as soon as possible to counter any potential threats.
News URL
https://thehackernews.com/2022/03/critical-rce-bugs-found-in-pascom-cloud.html
Related news
- Four Critical Vulnerabilities Expose HPE Aruba Devices to RCE Attacks (source)
- Over 50,000 Tinyproxy servers vulnerable to critical RCE flaw (source)
- Critical Git vulnerability allows RCE when cloning repositories with submodules (CVE-2024-32002) (source)
- Critical Fluent Bit flaw impacts all major cloud providers (source)
- Critical Fluent Bit flaw affects major cloud platforms, tech companies’ offerings (CVE-2024-4323) (source)
- Critical Fluent Bit bug affects all major cloud providers, say researchers (source)
- TP-Link fixes critical RCE bug in popular C5400X gaming router (source)
- PHP fixes critical RCE flaw impacting all versions for Windows (source)
- Critical RCE flaws in vCenter Server fixed (CVE-2024-37079, CVE-2024-37080) (source)
- VMware fixes critical vCenter RCE vulnerability, patch now (source)