CVE-2026-73665Critical· 9.8▾ MidnightFreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Last analysed / modified upstream
— → 9.8
none → critical
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
freepbx < 17.0.9Upgrade past the affected range:
freepbx 17.0.9Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59429Medium· 5.4FreePBX is an open source GUI for managing Asterisk
CVE-2025-67722High· 7.8FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk
CVE-2025-67736High· 7.2The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk
CVE-2026-75600High· 8.8FreePBX is an open source IP PBX
CVE-2026-54675High· 8.8FreePBX is an open source IP PBX
CVE-2026-54708High· 8.8FreePBX is an open source IP PBX