CVE-2016-2363: Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/w...

Security readout for executives and security teams

This issue affects older Fonality, previously trixbox Pro, systems. A weakly protected server-side script could let a local user escalate to root by leveraging access to the nobody account. The business risk is highest for legacy PBX systems still running versions before the June 1, 2016 fix window. Exposure is limited to organizations still operating Fonality or trixbox Pro 12.6 through 14.1i builds from before 2016-06-01. Systems are more concerning where local shell access, web-process compromise, or access to the nobody account is plausible. Treat this as a high-priority legacy-system risk if Fonality or trixbox Pro remains in production. It is less urgent for organizations without the product, but affected PBX systems should be upgraded, isolated, or retired because root compromise can affect voice services and adjacent infrastructure. Mitigation focus: Inventory Fonality or trixbox Pro PBX systems and confirm exact versions.; Prioritize upgrade or vendor-supported remediation for builds before 2016-06-01.; Restrict local shell access and administrative access to affected systems..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.