FreePBX CVE-2026-73665

Exploitation requires network reachability to the FreePBX UCP Node server on TCP ports 8001 or 8003 and a FreePBX version prior to 17.0.9; the attacker connects to a Socket.IO custom namespace (not the default namespace) where checkAuth is not consistently invoked, then supplies event values containing CR/LF characters routed through the AMI action path in asterisk-manager-patch.js. No authentication is required (PR:N) and no user interaction is needed (UI:N). The primary limiting factor is exposure of ports 8001/8003: deployments that firewall these ports to trusted networks, or that do not run the UCP Node server, are not remotely reachable and are effectively protected regardless of version.

This is a genuine high-priority issue rather than a paper-high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) indicates network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact on the vulnerable system, which is consistent with the description of an unauthenticated client bypassing auth on custom namespaces. No EPSS score, SSVC decision, or KEV entry was provided, and no POC is referenced, so real-world exploitation cannot be confirmed and appears not yet widespread. The main uncertainty is exposure: ports 8001/8003 must be reachable by the attacker, so risk is highest where the UCP Node server is exposed to untrusted networks and lower where it sits behind a firewall or VPN. Missing signals (EPSS, SSVC, POC status) should be treated as unknown, not as evidence of low risk.

An attacker who can reach ports 8001 or 8003 opens a Socket.IO connection to a custom namespace that skips checkAuth, bypassing authentication entirely. They then send a crafted event whose value embeds carriage-return/newline characters, injecting an extra Asterisk Manager Interface action that runs shell commands as the asterisk user. No public POC is referenced, but the low attack complexity and lack of required authentication or user interaction make weaponization straightforward for a capable attacker.