CVE-2026-46376criticalCWE-798

CVE-2026-46376: falha crítica em FreePBX security-reporting

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar security-reporting

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.3epss 0.4%
da publicação à armano mesmo dia
Publicada no NVD29 de mai.
1ª PoC29 de mai.
FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP is required for the initial setup of UCP generic templates, but after that, without further steps by the admin, unauthenticated users may be able to gain access. This vulnerability is fixed in 16.0.45 and 17.0.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
FreePBX · security-reporting
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — FreePBX security-reporting

No mesmo produto, das mais perigosas para as menos.

CVE-2026-28287HIGHFreePBX: Authenticated Remote Code Execution via Recordings Module AJAX EndpointsEPSS 9.3%CVE-2026-44237HIGHFreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API ModuleEPSS 2.7%CVE-2026-28209HIGHFreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integrationEPSS 1.0%CVE-2026-26978HIGHFree PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.phpEPSS 0.9%CVE-2026-54674HIGHAuthenticated Command Injection in FreePBX UCP InterfaceEPSS 0.9%CVE-2026-75600HIGHFreePBX: Authenticated API generatedocs Host Command InjectionEPSS 0.8%