ZDI-23-1153: 3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability
Published Aug 21, 2023
·Updated
This vulnerability allows local attackers to escalate privileges on affected installations of 3CX. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Affected Software
1 affected component
3CX 3CX
Event History
Aug 21, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Mar 26, 2025
Advisory Published
via ZDI·09:46 PM
Frequently Asked Questions
1
What is the severity of ZDI-23-1153?
The severity of ZDI-23-1153 is considered critical as it allows local privilege escalation.
2
How can I mitigate ZDI-23-1153?
To mitigate ZDI-23-1153, ensure you are using the latest version of 3CX with all security patches applied.
3
What systems are affected by ZDI-23-1153?
ZDI-23-1153 affects installations of 3CX, specifically those that allow execution of low-privileged code.
4
Who can exploit the vulnerability ZDI-23-1153?
Local attackers with the ability to execute low-privileged code on the target system can exploit ZDI-23-1153.
5
Is there a workaround for ZDI-23-1153?
There are no known workarounds for ZDI-23-1153, so applying the necessary updates is essential.