CVE-2016-2363: Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/

Routine

HIGH 7.8DOWNGRADE

CVE-2016-2363 is a high-severity flaw (CVSS 7.8) affecting fonality. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account.

Why this priority

High severity

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.6% (top 52%)
CISA exploited list	No
Weakness	CWE-264
Published	2016-06-20
Last modified	2026-06-17

Publisher (CNA): CERT/CC · Vendor: fonality

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2016-06-20 01:59 UTCPublished CVE record published
2026-06-17 00:43 UTCUpdated Record last modified

fonality fonality DOWNGRADE

Affected: 12.6 · 12.8 · 14.1i

Fixed in: no fixed release known

Safe to downgrade to: a release before 12.6

1. Check installed version

apt-cache policy fonality || rpm -q fonality || fonality --version

2. No fixed release: DOWNGRADE to a release before 12.6 (Debian / Ubuntu)

apt-cache madison fonality sudo apt install fonality=<VERSION_BEFORE_12.6> sudo apt-mark hold fonality

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list fonality sudo dnf downgrade fonality-<VERSION_BEFORE_12.6> sudo dnf versionlock add fonality

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2016-2363?

fonality: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2016-2363 being exploited?

CVE-2016-2363 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2016-2363 affect?

CVE-2016-2363 affects fonality. Severity is high (CVSS 7.8). Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nob

How urgent is CVE-2016-2363?

Priority 39/100. High severity

Related CVEs

CVE-2016-2364 HIGH 7.5 UPGRADE DOWNGRADE The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the s
CVE-2016-2362 CRITICAL 9.8 DOWNGRADE Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP ac

References

← Back to latest CVEs