Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-73665 FreePBX UCP Node Arbitrary Command Execution via Unauthenticated Namespace Connection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73665
Post summary
This entry announces CVE-2026-73665, a flaw that allows arbitrary command execution in FreePBX UCP through an unauthenticated namespace connection, with further details accessible via the provided link.