CVE-2026-73665

{
  "etk_id": "ETK-2026-3543",
  "cve_id": "CVE-2026-73665",
  "display_id": "CVE-2026-73665",
  "ghsa_id": "GHSA-37j8-fhxx-9vhp",
  "euvd_id": "EUVD-2026-58541",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass and command injection in FreePBX UCP",
  "summary": "FreePBX UCP Node service versions before 17.0.9 may fail to enforce authentication for certain Socket.IO endpoints. An unauthenticated remote attacker who can reach the UCP Node service can execute commands as the Asterisk service account.",
  "mitigation": "Upgrade the FreePBX ucp package to version 17.0.9 or later. Until upgraded, restrict access to the UCP Node service on ports 8001 and 8003 to trusted networks.",
  "vendor": "Sangoma",
  "product": "FreePBX",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 17.0.9"
      ],
      "ecosystem": "freepbx 17",
      "fixed_versions": [
        "17.0.9"
      ],
      "package_name": "ucp",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.3,
  "cvss_src": "other",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 59.333583966666666,
  "t0_at": "2026-08-13T21:32:02.059000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-04T22:16:05.261695+00:00",
      "days": 83.03059262378473,
      "is_lower_bound": false,
      "measured_at": "2026-08-13T21:32:02.059000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-11-04T22:16:05.261695+00:00",
      "days": 83.03059262378473,
      "is_lower_bound": false,
      "measured_at": "2026-08-13T21:32:02.059000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-11-04T00:00:00+00:00",
      "days": 83,
      "is_lower_bound": false,
      "measured_at": "2026-08-13T21:32:02.059000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-73665"
    },
    "trigger_signal": {
      "at": "2026-11-04T00:00:00+00:00",
      "days": 82.10275394675926,
      "is_lower_bound": false,
      "measured_at": "2026-08-13T21:32:02.059000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-73665"
    }
  }
}