CVE-2024-0986: Issabel PBX Asterisk-Cli command injection via Command argument

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with a public exploit and very high EPSS, on an internet-reachable telephony appliance with no confirmed vendor fix.

What it is

Issabel PBX 4.0.0 exposes the Asterisk-Cli component at /index.php?menu=asterisk_cli, where the Command argument is passed to a shell without sanitization, allowing OS command injection. The flaw is rated critical and a public exploit exists, so unpatched internet-facing deployments are at immediate risk. The vendor was contacted but did not respond, so no official fix is confirmed in this record.

Impact

An attacker can execute arbitrary operating system commands on the PBX host, leading to full compromise of confidentiality, integrity and availability. On a telephony server this can mean call interception, credential theft and use of the host as a pivot into the internal network.

Attack surface

The vulnerable endpoint is reachable over the network via HTTP on the PBX web interface. The CVSS vector indicates no privileges or user interaction are required, though one reference is titled 'authenticated remote code execution', so the record is inconsistent on whether a valid session is needed.

Exploitation

A public exploit is referenced and EPSS is 0.58153 (99th percentile), indicating high likelihood of exploitation activity. The CVE is not listed in CISA KEV and no ransomware usage is documented.

What to do

• Apply the vendor fix if one becomes available; the vendor did not respond to the disclosure, so check Issabel advisories and community patches directly.
• If no patch exists, restrict access to the PBX web interface to trusted management networks and remove internet exposure.
• Enforce authentication and least privilege on the admin interface, and disable or block the asterisk_cli menu for non-admin users.
• Run the PBX service under a low-privilege account and apply egress filtering so injected commands cannot reach internal systems.
• Monitor Issabel community and VULDB entries for an updated fix and re-test after any change.

Detection

• Alert on HTTP requests to /index.php?menu=asterisk_cli containing shell metacharacters (;, |, &&, $(), backticks) in the Command parameter.
• Monitor web server and PBX process trees for child processes spawned by the web server user, especially shells and system utilities.
• Review PBX host logs for unexpected outbound connections or new listening services following admin interface activity.
• Baseline normal asterisk_cli usage and alert on commands outside that baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.