CVE-2025-2292
📋 TL;DR
Xorcom CompletePBX versions through 5.2.35 contain an authenticated path traversal vulnerability in the Backup and Restore functionality. This allows authenticated attackers to read arbitrary files on the system. Organizations running affected CompletePBX versions are at risk.
💻 Affected Systems
- Xorcom CompletePBX
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, configuration files, or credential files, potentially leading to full system compromise.
Likely Case
Attackers with valid credentials can exfiltrate sensitive configuration data, user information, or system files.
If Mitigated
With proper access controls and network segmentation, impact is limited to file disclosure within the application's context.
🎯 Exploit Status
Exploitation requires authenticated access to the Backup and Restore functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.36.1
Vendor Advisory: https://www.xorcom.com/new-completepbx-release-5-2-36-1/
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download CompletePBX 5.2.36.1 from Xorcom. 3. Follow vendor upgrade instructions. 4. Restart the PBX system.
🔧 Temporary Workarounds
Restrict Backup and Restore Access
allLimit access to the Backup and Restore functionality to only necessary administrative users.
Network Segmentation
allIsolate CompletePBX systems from sensitive network segments and restrict external access.
🧯 If You Can't Patch
- Implement strict access controls and multi-factor authentication for all administrative accounts
- Monitor and audit access to the Backup and Restore functionality for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check CompletePBX version via web interface or command line. Versions 5.2.35 and earlier are vulnerable.Check Version:
Check web interface dashboard or run 'dpkg -l | grep completepbx' on the systemVerify Fix Applied:
Verify system is running CompletePBX version 5.2.36.1 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns via Backup/Restore functionality
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Unusual outbound data transfers from PBX system
- Traffic patterns indicating file enumeration
SIEM Query:
source="completepbx" AND (event="backup" OR event="restore") AND file_path CONTAINS ".."