Vulnerability record · CVE-2019-11409 · published 17 June 2019
CVE-2019-11409: FusionPBX Operator Panel exec.php command injection
Fusionpbx · Fusionpbx
FusionPBX 4.4.3's Operator Panel module (app/operator_panel/exec.php) fails to validate input, allowing OS command injection. An authenticated non-administrative user can run commands on the host, and the flaw can be chained with an XSS in the same module to reach remote code execution.
Description
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with low-privilege network access, public exploit references, and a very high EPSS score make this a high-priority fix despite no KEV listing.
What it is
FusionPBX 4.4.3's Operator Panel module (app/operator_panel/exec.php) fails to validate input, allowing OS command injection. An authenticated non-administrative user can run commands on the host, and the flaw can be chained with an XSS in the same module to reach remote code execution.
Impact
An attacker gains arbitrary command execution on the FusionPBX host, and via the XSS chain can escalate to full remote code execution, compromising the PBX and its data.
Attack surface
Reached over the network through the Operator Panel web interface; the CVSS vector shows low privileges required (PR:L) and no user interaction (UI:N), so any authenticated non-admin account suffices.
Exploitation
Not listed in CISA KEV, but EPSS is 0.8748 (99.7th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.
What to do
- Apply the vendor patch commit e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611 or upgrade FusionPBX past 4.4.3.
- Restrict access to the Operator Panel to trusted networks or administrative users only.
- Review and remove unnecessary non-administrative accounts that can reach the Operator Panel.
- Fix the associated XSS in the Operator Panel module to break the RCE chain.
- Monitor host command execution and web server logs for suspicious activity from the Operator Panel.
Detection
- Alert on unusual child processes spawned by the web server or PHP-FPM.
- Monitor HTTP requests to app/operator_panel/exec.php for command metacharacters.
- Audit Operator Panel access logs for non-administrative accounts.
- Watch for outbound connections or file writes originating from the PBX host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-11409 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-11409), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
