Vulnerability Description
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-73665?
CVE-2026-73665 is a documented vulnerability. FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the ...
How severe is CVE-2026-73665?
CVSS scoring is not yet available for CVE-2026-73665. Check NVD for updates.
Is there a patch for CVE-2026-73665?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.