Posted by disclosure via Fulldisclosure on Oct 150day Rubbish Research Team is publicly disclosing a vulnerability in Auerswald COMmander 6000 and COMmander 6000R, firmware 8.6D build 128154, the closed-source enterprise IP-PBX and unified-communications appliances from Auerswald (Germany). Two unauthenticated HTTP requests, carrying no cookie and no credential of any kind, yield uid=0(root) gid=0(root) groups=0(root) on an appliance that holds extension credentials, SIP trunk credentials, call...