Vulnerability · Published Mar 31, 2025 · Assigned by VulnCheck
CVE-2025-30004Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injection
High 8.8
In plain English
A high-severity OS command injection in CompletePBX from Xorcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)4.3%top 8.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Metasploit
Official description
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Xorcom | CompletePBX | 0 – through 5.2.35 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://vulncheck.com/advisories/completepbx-authenticated-command-injection third-party-advisory
- https://www.xorcom.com/new-completepbx-release-5-2-36-1/ vendor-advisory