This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Path Traversal in Xorcom CompletePBX. <br>๐ฅ **Consequences**: Attackers can read arbitrary files on the server. Critical data exposure risk.
๐ข **Vendor**: Xorcom. <br>๐ฆ **Product**: CompletePBX. <br>๐ **Affected**: Version 5.2.35 and earlier. Newer versions are safe.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Action**: Read arbitrary system files. <br>๐ **Privileges**: Requires Local Privileges (PR:L). <br>๐ **Impact**: High Confidentiality (C:H), No Integrity/Availability impact.
Q5Is exploitation threshold high? (Auth/Config)
๐ **Auth**: YES. Requires Local Privileges. <br>๐ **Network**: Network Accessible (AV:N). <br>โ ๏ธ **Threshold**: Medium. Not remote unauthenticated, but local network access is sufficient.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฃ **Public Exp?**: No PoCs listed in data. <br>๐ **Wild Exp**: Low. Likely requires specific local access or crafted requests by authenticated users.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for CompletePBX instances. <br>๐งช **Test**: Attempt path traversal payloads (`../`) if local access is granted. <br>๐ **Verify**: Check installed version against 5.2.35.
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: YES. <br>๐ฅ **Patch**: Update to version 5.2.36.1. <br>๐ **Source**: Xorcom vendor advisory released March 2025.
Q9What if no patch? (Workaround)
๐ก๏ธ **Workaround**: Restrict network access to PBX. <br>๐ซ **Limit**: Ensure only trusted local users have access. <br>๐ **Monitor**: Log file access attempts closely.
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: HIGH. <br>โ๏ธ **Reason**: CVSS 7.5 (High). Easy to exploit (AC:L) if local access exists. <br>๐ **Action**: Patch immediately to 5.2.36.1.