CVE-2026-73665 — FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

Description (CNA)

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.

Affected (CNA)

Vendor / product	Versions
FreePBX / ucp	affected < 17.0.9

CWE

CWE-862

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-37j8-fhxx-9vhp

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.