CVE-2026-73665: FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX UCPto a version that resolves this vulnerability.Fixed in 17.0.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73665?
The severity of CVE-2026-73665 is rated at 85, indicating a high level of risk.
How do I fix CVE-2026-73665?
To fix CVE-2026-73665, upgrade FreePBX to version 17.0.9 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-73665?
CVE-2026-73665 is an unauthenticated remote code execution vulnerability affecting FreePBX UCP.
What products are affected by CVE-2026-73665?
CVE-2026-73665 affects FreePBX versions prior to 17.0.9, specifically the UCP Node server.
What could an attacker do with CVE-2026-73665?
An attacker exploiting CVE-2026-73665 could execute arbitrary code on the FreePBX server due to socket.io namespace auth bypass.