An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could…

Description

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server (via /Electron/download directory traversal in conjunction with a path component that uses backslash characters), leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. NOTE: this issue exists because of an incomplete fix for CVE-2022-48482.

Scores

EPSS (exploitation in 30 days)

8.3% · top 5.0% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• n/a
• CWE-522 (opens in a new tab)All about CWE-522 and its CVEs

Affected products

• n/a

  • affected n/a

References (4)

• https://www.3cx.com/blog/change-log/phone-system-change-log/ (opens in a new tab)x_transferred
• https://www.3cx.com/blog/releases/v18-update-3-final/ (opens in a new tab)x_transferred
• https://www.3cx.com/blog/releases/v18-security-hotfix/ (opens in a new tab)x_transferred
• https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-28005](https://trackcve.app/badge/CVE-2022-28005.svg)](https://trackcve.app/cve/CVE-2022-28005)

Record last updated 3 Aug 2024, 05:41 UTC.