CVE-2026-73665 is a critical (CVSS 9.8) missing authentication flaw in the FreePBX UCP Node server. An unauthenticated client can reach custom Socket.IO namespaces and run commands as the asterisk user. Update the ucp module to 17.0.9 and restrict ports 8001 and 8003.
What's affected
FreePBX 17 with the ucp module before 17.0.9. The fixed version is 17.0.9, per the FreePBX advisory and the record.
The UCP Node server listens on port 8001, or 8003 with TLS, by default. The advisory sets the provider urgency to Red and says to act immediately. It describes the impact as unauthenticated, remote, zero interaction code execution as the asterisk user on an internet facing FreePBX 17 with UCP and no or inadequate firewall.
The advisory ties the cause to changes in recent Socket.IO versions that removed some authentication protections.
How to check if you're exposed
List the module version.
fwconsole ma list | grep -i ucp
See whether the UCP Node ports are listening and to whom.
ss -tlnp | grep -E ":(8001|8003)"
Then check from an outside network whether those ports answer. Review the FreePBX Firewall settings, with attention to the Trusted and Local zones under Connectivity, Firewall, Networks, as the advisory recommends.
What to do now
- Update the ucp module to 17.0.9 or later.
- Block ports 8001 and 8003 from untrusted networks right away if you cannot update at once.
- Use the FreePBX Firewall module with Responsive Firewall, as the advisory suggests, so UCP is only open to IPs that have registered a SIP endpoint.
- Review the Trusted and Local zones in the firewall for ranges that should not be there.
- Check the system for unexpected users, processes, dialplan changes and scheduled jobs under the asterisk account.
Why it matters
The record maps this to CWE-862, missing authorization. The server registered an authentication check with io.use, but in Socket.IO version 4 that middleware applies only to the default namespace. Custom namespaces did not consistently run the check, so an unauthenticated client could talk to them.
The second part is how it becomes command execution. Event values containing line break characters reach the Asterisk Manager Interface, which reads commands line by line, so one event can carry extra commands. That is injection through a protocol delimiter.
Two lessons follow. When a framework changes where its authentication hook applies, every endpoint built on the old assumption needs a recheck. And management ports should never face the internet without a firewall. The KEV flag is false and the record does not describe exploitation.
Working through the response
Begin with exposure, because it decides how fast you move. Run the listening port check on every FreePBX 17 host and note which ones answer from the internet. The advisory describes an internet facing system with UCP and a weak firewall as the worst case. If a host fits, block the two ports first and update second, since a firewall rule takes seconds and the module update may need a window.
After updating, review the system as if someone may have been there. The advisory says commands run as the asterisk user, so look at what that user could change: dialplan files, extensions and trunk settings, scheduled jobs, and any new files in its home or the web directories. Toll fraud is the classic risk on a PBX, so check call detail records for unexpected outbound calls to premium or international numbers. This is a precaution drawn from how PBX systems are used, and the record does not say any attacks occurred.
Authentication hooks and framework upgrades
The cause is worth remembering because it can happen in any service that uses a framework. The server called a middleware function that was meant to guard every connection. A later framework version changed where that call applies, and custom namespaces fell outside it. Nothing in the application code changed, yet the guard stopped covering them. After a major framework upgrade, test unauthenticated access to every endpoint, not only the default one, and treat the absence of a failure as a result to verify rather than assume.
The second ingredient is a protocol where line breaks separate commands. Any time user supplied text is placed into such a protocol, break characters must be rejected or encoded. The Asterisk Manager Interface reads commands line by line, so one value containing a line break can carry more than one command.
The free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project you maintain pulls in an affected package, and the Gold vulnerability directory keeps the record for this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does FreePBX 16 have this problem?
The advisory lists FreePBX 17 and the ucp module below 17.0.9. It does not list FreePBX 16 for this issue.
What if I cannot update today?
Block ports 8001 and 8003 from untrusted networks and use the Responsive Firewall, as the advisory advises.
Sources
Last reviewed: 19 October 2026.
