FreePBX implements a user control panel (UCP) that can be accessed without authentication if the administrator does not change the hard‑coded initial template credentials. The vulnerability exists from version 15.0.42 to just before 16.0.45 and from 17.0.0 up to 17.0.7. Once an attacker obtains these default credentials they can log in and manage PBX configurations, exposing the system to arbitrary changes, eavesdropping, or further compromise. The CVSS score of 9.3 indicates a critical effect on confidentiality, integrity, and availability.

The issue affects the FreePBX platform, specifically versions 15.0.42 through 16.0.44 and the 17.0 series up to 17.0.7. No other vendors or products are listed, and the vulnerability is tied to the UCP interface of FreePBX.

The high CVSS score and the lack of authentication requirement result in a high risk of exploitation. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the scenario remains a critical threat because any unauthenticated user who can reach the UCP interface can leverage the default credentials. A likely attack vector is via the web interface, where attackers browse to the UCP installation page and supply the known default login credentials.