CVE-2019-9971

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump command, without a password. This occurs because the -z (aka postrotate-command) option to tcpdump can be unsafe when used in conjunction with sudo.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.gosecure.net/blogThird Party Advisory
https://www.gosecure.net/blog/2022/05/31/security-advisory-multiple-vulnerabilities-impact-3cx-phone-system/Exploit, Third Party Advisory
https://www.securusglobal.com/community/2014/03/17/how-i-got-root-with-sudo/Third Party Advisory
https://www.gosecure.net/blogThird Party Advisory
https://www.gosecure.net/blog/2022/05/31/security-advisory-multiple-vulnerabilities-impact-3cx-phone-system/Exploit, Third Party Advisory
https://www.securusglobal.com/community/2014/03/17/how-i-got-root-with-sudo/Third Party Advisory

Timeline

Published: Jun 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-99728.8PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands CVE-2019-99749.1diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a pin CVE-2019-99757.5DASAN H660RM devices with firmware 1.03-0022 use a hard-coded key for logs encryption. Data stored using this key can be decrypted by anyone CVE-2019-99768.8The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-i CVE-2019-99778.8The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger fir CVE-2019-99786.1The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter