EXPOSURES › CVE-2026-73665
CVE-2026-73665
CRITICALFreePBX UCP Node server allowed unauthenticated remote code execution via crafted event values before version 17.0.9.
An unauthenticated client could connect to custom namespaces on ports 8001 and 8003, bypassing authentication checks and executing arbitrary commands as the asterisk service user. DIB organizations must ensure FreePBX is patched to version 17.0.9 or later to prevent remote code execution and potential system compromise.
Shame score — The vulnerability allowed unauthenticated remote code execution, which is a severe and avoidable failure that could lead to full system compromise.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.