EIP-2026-107175

This exploit demonstrates a command injection vulnerability in Trixbox's endpoint_aastra.php file, allowing unauthenticated remote code execution (RCE) with root privileges via sudo abuse. The vulnerability arises from unsanitized user input in the 'mac' parameter passed to an exec() call.