CVE-2024-0986

What it actually does

CVE-2024-0986 is an operating system command injection vulnerability in the Issabel PBX 4.0.0 Asterisk-Cli component exposed through `/index.php?menu=asterisk_cli`. Improper handling of the `Command` argument allows attacker-controlled input to be interpreted by the underlying shell. Because the vulnerability is remotely reachable, low-complexity, and rated CVSS 9.8 with public weaponized exploit availability, successful exploitation can result in arbitrary command execution on the PBX host with the privileges of the web/PBX service account. This can enable full compromise of call infrastructure, credential theft, persistence, lateral movement, data exfiltration, call interception, service disruption, or malware deployment.

Why it matters to the business

A compromised PBX can disrupt phone service, expose call records or voicemail, enable toll fraud, allow attackers to pivot deeper into the network, and create an operational outage affecting customer support, sales, emergency communications, or internal collaboration. The high EPSS score, weaponized public exploit status, and long time since publication increase the likelihood of opportunistic internet-scale scanning and exploitation. Organizations running affected Issabel PBX systems should treat exposure as urgent even though the issue is not currently listed in CISA KEV and no ransomware association is reported.

How an attack unfolds

An attacker identifies an Issabel PBX instance reachable over the network and probes the web interface for the Asterisk-Cli endpoint at `/index.php?menu=asterisk_cli`. The attacker sends a crafted request containing a malicious `Command` parameter that includes shell metacharacters or command separators. Instead of treating the value only as an Asterisk CLI command, the application passes attacker-controlled content to an operating system command execution context. The attacker then executes reconnaissance commands such as identity, hostname, network, and file discovery commands, followed by payload retrieval using tools such as `curl`, `wget`, or shell redirection. After initial command execution, the attacker may deploy a web shell, create persistence, harvest PBX credentials and call data, modify telephony configuration, conduct toll fraud, or use the PBX host as a foothold for lateral movement.

How to fix it

Upgrade Issabel PBX to a version that contains a vendor-provided fix if one becomes available. No fixed version was provided in the available vulnerability metadata, and the vendor reportedly did not respond to the initial disclosure, so compensating controls are important. Remove public internet exposure for the Issabel administrative interface and restrict access to trusted management networks or VPN only. Block access to `/index.php?menu=asterisk_cli` unless explicitly required. Disable or remove the Asterisk-Cli web component where possible. Enforce strong authentication and MFA for PBX administration, but do not rely on authentication alone if the vulnerable endpoint is remotely reachable. Use a reverse proxy or WAF rule to block requests to the vulnerable path and requests containing suspicious command-injection metacharacters in the `Command` parameter. Harden the host by minimizing service privileges, restricting outbound network access from the PBX, disabling unnecessary interpreters/tools where feasible, and monitoring for unauthorized configuration changes. If compromise is suspected, rebuild from trusted media, rotate PBX, SIP, administrative, and database credentials, review call routing for fraud, and validate telephony configuration integrity.

How to confirm the fix worked

Confirm whether Issabel PBX 4.0.0 or another vulnerable build is in use by checking the application version through the administrative interface, package manager, or installed product files. Verify that `/index.php?menu=asterisk_cli` is not reachable from untrusted networks. From an authorized test network, confirm that requests to the Asterisk-Cli endpoint are denied, require appropriate access controls, or are blocked by compensating controls. Review WAF, reverse proxy, and web server rules to ensure the vulnerable path and suspicious `Command` parameter patterns are blocked. Validate that the PBX still performs required business functions after disabling or restricting the Asterisk-Cli component. If a vendor patch is later applied, retest the endpoint with benign command-injection payloads in a controlled manner to confirm user input is not executed by the operating system.

Typical attack path

1. Scan for internet-exposed Issabel PBX web interfaces.
2. Request `/index.php?menu=asterisk_cli` to confirm the Asterisk-Cli component is accessible.
3. Submit a crafted `Command` argument containing shell metacharacters or command separators.
4. Execute simple proof commands such as `id`, `whoami`, `uname -a`, or `pwd` to confirm command execution.
5. Download or stage additional payloads using `curl`, `wget`, `bash`, `sh`, Python, Perl, or similar interpreters.
6. Harvest PBX configuration, credentials, voicemail, call records, and SIP trunk information.
7. Modify PBX settings, create persistence, deploy malware or web shells, disrupt service, or pivot to adjacent systems.

How to detect it

Review historical web access logs, reverse proxy logs, WAF events, and application logs for requests to `/index.php?menu=asterisk_cli`, especially POST or GET requests with a `Command` parameter containing shell metacharacters such as `;`, `|`, `&&`, backticks, `$()`, URL-encoded equivalents, or commands such as `id`, `whoami`, `uname`, `curl`, `wget`, `bash`, `sh`, `python`, `perl`, `nc`, or `chmod`. Correlate suspicious web requests with operating system logs, process execution telemetry, EDR alerts, shell history, cron changes, new files in web-accessible directories, outbound network connections, and unexpected child processes spawned by the web server or PBX service account. Examine PBX and Asterisk logs for unusual CLI activity, configuration changes, new extensions, altered trunks, anomalous outbound call patterns, voicemail access anomalies, or call spikes that may indicate toll fraud. Check for payload staging in temporary directories and web roots, unauthorized PHP files, newly created users, SSH key additions, modified startup scripts, and suspicious outbound connections shortly after requests to the vulnerable endpoint.

• /index.php?menu=asterisk_cli
• menu=asterisk_cli
• Command=
• Command=id
• Command=whoami
• Command=uname
• Command=cat%20/etc/passwd
• Command=curl
• Command=wget
• Command=bash
• Command=sh
• Command=python
• Command=perl
• Command=nc
• Command=chmod
• Command=rm%20-rf
• Command=%3B
• Command=;
• Command=%7C
• Command=|
• Command=%26%26
• Command=&&
• Command=%60
• Command=`
• Command=%24%28
• Command=$(
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/asterisk/full
• /var/log/asterisk/messages
• /var/www/html/*.php
• /tmp/
• /var/tmp/
• asterisk_cli

What your security team should do

• Immediately inventory Issabel PBX deployments and identify any version 4.0.0 systems or internet-exposed administrative interfaces.
• Treat exposed instances as high priority because exploitation is public, weaponized, remotely reachable, and associated with a high EPSS probability.
• Restrict Issabel PBX administration to VPN or trusted management networks and block public access to `/index.php?menu=asterisk_cli`.
• Deploy WAF or reverse proxy rules that deny the vulnerable path and suspicious `Command` parameter content containing shell metacharacters, command separators, or payload download commands.
• Review web, PBX, system, and network logs for historical exploitation attempts and successful command execution artifacts.
• If exploitation is suspected, isolate the PBX, preserve forensic evidence, rotate credentials, review call records for toll fraud, and rebuild from a trusted baseline.
• Monitor vendor advisories and community-maintained Issabel security updates for an official fixed release or backported patch.
• Implement egress filtering from PBX systems to reduce payload download, command-and-control, and data exfiltration opportunities.