CVE-2007-6424: registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes...

Security readout for executives and security teams

This flaw concerns legacy Fonality Trixbox 2.0 PBX systems. A script could fetch and run commands from a remote website without adequately proving the commands came from the right place. If an attacker could spoof DNS in the right environment, they could disable the PBX and run arbitrary commands. Exposure is most likely in organizations still running legacy Trixbox 2.0 PBX deployments, especially where registry.pl remains present and can reach the remote command source. The source bundle does not provide CPEs, supported versions beyond Trixbox 2.0, or exact environmental prerequisites. High if any Trixbox 2.0 instance remains in production, because compromise could affect voice availability and host command execution. For most organizations this is a legacy exposure issue, not a current emergency, unless inventory confirms active use. Mitigation focus: Inventory for Trixbox 2.0 systems and prioritize replacement if still operational.; Check archived Fonality/Trixbox guidance before assuming any patch exists.; Disable or remove the vulnerable phone-home behavior only if operationally safe and vendor-supported..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.