Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2006-6244: FreePBX before 2.2.0rc1 enables command execution via caller ID fields

CVE-2006-6244 · published 19 years ago

Summary

FreePBX versions earlier than 2.2.0rc1 let an attacker place special characters in the caller ID name or number, which the system then runs as a command on the server. This can allow the attacker to run any code they choose, potentially taking control of the phone system. Upgrade to 2.2.0rc1 or later, or apply the vendor’s patch, and ensure caller ID data is strictly validated.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
coalescent_systems	freepbx	<= 2.1.3 `cpe:2.3:a:coalescent_systems:freepbx::::::::`

Original advisory text

Coalescent Systems freePBX (formerly Asterisk Management Portal) before 2.2.0rc1 allows attackers to execute arbitrary commands via shell metacharacters in (1) CALLERID(name) or (2) CALLERID(number).

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Timeline

Published4 Dec 2006

Updated1 Nov 2026

First seen29 Sep 2026

Sources

CVE-2006-6244 · NVD

Track software like this

Free during beta