CVE-2023-29059

3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 of the 3CX...

3CX DesktopApp Malware

The version of the 3CX DesktopApp installed on the remote host contains malware. In the absence of a published vendor advisory, current guidance from 3CX and other sources is to uninstall this software and await an updated version to be published by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Command injection

PhoneSystem Terminal in 3CX Phone System Debian based installation 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump command, without a password. This occurs because the -z aka postrotate-command option to tcpdump can be unsafe when used in conjunction with sud...

Command injection

PhoneSystem Terminal in 3CX Phone System Debian based installation 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of " followed by " mishandling...

CVE-2019-9972

The CVE-2019-9972 issue affects 3CX Phone System (Debian-based) version 16.0.0.1570, where an authenticated attacker can run arbitrary commands as the phonesystem user due to mishandling of a local input pattern: " followed by ". The vulnerability is a command injection in the PhoneSystem Termina...

CVE-2019-9972

PhoneSystem Terminal in 3CX Phone System Debian based installation 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of " followed by " mishandling...

CVE-2019-9971

The CVE-2019-9971 entry concerns PhoneSystem Terminal in 3CX Phone System (Debian-based installation) 16.0.0.1570. The issue is a privilege-escalation vulnerability where an attacker can gain root privileges by using sudo with the tcpdump command due to the -z (postrotate-command) option being un...

CVE-2022-28005

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server via /Electron/download directory traversal in conjunction with a path component that uses...

Directory traversal

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server via /Electron/download directory traversal in conjunction with a path component that uses...

CVE-2022-28005

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server via /Electron/download directory traversal in conjunction with a path component that uses...

CVE-2022-28005

CVE-2022-28005 affects the 3CX Phone System Management Console prior to version 18 Update 3 FINAL on Windows. It allows an unauthenticated attacker to traverse the server via /Electron/download with backslash-using path components, leading to cleartext credential disclosure; a subsequent authenti...

CVE-2021-45491

3CX System through 2022-03-17 stores cleartext passwords in a database...

CVE-2021-45491

3CX System through 2022-03-17 stores cleartext passwords in a database...

CVE-2021-45490

The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation...

Input validation

The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation...

Default credentials

3CX System through 2022-03-17 stores cleartext passwords in a database...

CVE-2021-45491

3CX System through 2022-03-17 stores cleartext passwords in a database...

CVE-2021-45491

CVE-2021-45491 affects 3CX System up to 2022-03-17, where passwords are stored in cleartext in the database and are exportable via the management interface. The vulnerability stems from storing credentials in an unencrypted form, enabling potential disclosure of user passwords. The public documen...

CVE-2021-45490

The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation...

CVE-2021-45490

The CVE-2021-45490 entry concerns 3CX client software (Windows, iOS, Android) through 2022-03-17 where TLS/SSL certificate validation is not performed. The NVD entry documents this as a vulnerability in the clients’ TLS handling, with CVSS v3.1 base score 9.1 (network attack, no privileges, high ...