CVE-2026-73665
CriticalCVSS 9.3Summary
FreePBX prior to 17.0.9 has a vulnerability in the UCP Node server on ports 8001 and 8003, where the checkAuth middleware is applied only to the default Socket.IO namespace. An unauthenticated client can connect to custom namespaces and send crafted event values with CR/LF, allowing arbitrary commands to execute as the asterisk service user.
Risk Assessment
An attacker can execute arbitrary commands on the system, leading to full compromise of the PBX server and interception of communications.
Recommendation
Upgrade FreePBX to version 17.0.9, which contains the fix.
Original NVD description (English source)
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.