CVE-2022-28005

Deeper analysis

CVE-2022-28005 affects the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. The flaw stems from improper access controls on the /Electron/download endpoint that permit directory traversal using backslash path components, allowing retrieval of arbitrary server files and disclosure of cleartext credentials. An authenticated attacker can then upload a file that overwrites a 3CX service binary, resulting in remote code execution as NT AUTHORITY\SYSTEM on Windows. The issue is noted as resulting from an incomplete fix for CVE-2022-48482.

An unauthenticated remote attacker can first exploit the traversal to obtain valid credentials, then authenticate and replace a privileged service binary to achieve full system compromise. The CVSS 9.8 rating reflects the combination of network-accessible unauthenticated file disclosure followed by authenticated code execution without user interaction.

Vendor advisories direct administrators to apply the security hotfix or upgrade to 18 Update 3 FINAL, as documented in the 3CX change log and release announcements.

Public technical analyses describe the full attack chain reachable from the internet, and the EPSS score rose from a low baseline to a peak of 0.3825, indicating growing exploitation interest after disclosure.