EUVD-2026-58541Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access to exposed Node ports with no user interaction gives PR:N/UI:N/AV:N/AC:L; command execution as the asterisk user yields full C/I/A impact, scope unchanged.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
AnalysisAI
Command injection in FreePBX UCP Node server before 17.0.9 allows unauthenticated remote attackers to run arbitrary OS commands as the asterisk service user. The Socket.IO 4 middleware (io.use(checkAuth)) only guards the default namespace, so a client can reach unprotected custom namespaces and inject carriage-return/newline characters into Asterisk Manager Interface actions to execute commands. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the FreePBX UCP Node server on TCP ports 8001 or 8003 and a FreePBX version prior to 17.0.9; the attacker connects to a Socket.IO custom namespace (not the default namespace) where checkAuth is not consistently invoked, then supplies event values containing CR/LF characters routed through the AMI action path in asterisk-manager-patch.js. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a paper-high score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach ports 8001 or 8003 opens a Socket.IO connection to a custom namespace that skips checkAuth, bypassing authentication entirely. They then send a crafted event whose value embeds carriage-return/newline characters, injecting an extra Asterisk Manager Interface action that runs shell commands as the asterisk user. … |
| Remediation | Vendor-released patch: upgrade FreePBX to version 17.0.9, which fixes the namespace authorization gap and the AMI CRLF handling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all FreePBX UCP Node servers in your environment and document their current versions; immediately restrict network access to the UCP Node server ports to authorized administrators and systems only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today