CVE-2026-73665 in FreePBX
Summary
by MITRE • 08/14/2026
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability affects FreePBX versions prior to 17.0.9 and specifically targets the UCP Node server components operating on ports 8001 and 8003. The flaw stems from a misconfiguration in how Socket.IO middleware is applied within the node/lib/server.js file, where io.use(checkAuth) is implemented but fails to properly enforce authentication checks across all namespaces due to Socket.IO version 4's behavior of applying middleware only to the default namespace. This creates a security gap that allows unauthenticated clients to establish connections to custom namespaces where authentication validation does not consistently occur through the node/lib/auth.js module.
The technical exploitation leverages the lack of proper input sanitization in the Asterisk Manager Interface action path, which is patched through the node/lib/asterisk-manager-patch.js component. Attackers can craft malicious event values containing carriage-return or newline characters that bypass authentication mechanisms and execute arbitrary commands with the privileges of the asterisk service user. This represents a critical privilege escalation vulnerability that transforms an unauthenticated connection into a fully authenticated administrative session capable of executing system-level commands.
The operational impact of this vulnerability is severe as it allows attackers to gain unauthorized access to the PBX system with elevated privileges, potentially leading to complete system compromise. The asterisk service user typically has significant system access rights including the ability to modify dial plans, access voicemail systems, manipulate call routing, and potentially exfiltrate sensitive communication data. This vulnerability directly violates the principle of least privilege and enables attackers to perform actions that should require proper authentication and authorization.
Organizations using affected FreePBX versions should immediately upgrade to version 17.0.9 or later to receive the patched authentication middleware implementation and input sanitization improvements. Network segmentation should be implemented to restrict access to ports 8001 and 8003, while monitoring should be deployed to detect anomalous connection patterns and command execution attempts. The vulnerability aligns with CWE-285 (Improper Authorization) and CWE-77 (Command Injection) categories, and represents a technique that could be categorized under ATT&CK tactic TA0006 (Credential Access) and technique T1078 (Valid Accounts) for privilege escalation. Additionally, the issue demonstrates characteristics of improper input validation that could be classified as part of the ATT&CK matrix's TA0002 (Execution) domain when arbitrary commands are executed through the patched interface.