FreePBX’s UCP Node server relied on socket.io middleware that was only applied to the default namespace, leaving non‑default namespaces vulnerable. An unauthenticated client could connect to these custom namespaces and send crafted event values that included carriage‑return or newline characters. Through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, the attacker could inject arbitrary commands, causing them to execute as the asterisk service user. The result is full remote code execution on the host running the service.

The vulnerability affects FreePBX UCP deployments that run versions earlier than 17.0.9 on ports 8001 or 8003. The UCP Node instance is part of the FreePBX open‑source IP PBX stack.

The CVSS score of 9.3 categorises this flaw as critical, and while the EPSS score is not available, the lack of a KEV listing does not diminish the immediately exploitable nature of the flaw. An attacker needs only network reach to the exposed UCP ports to establish a connection to a custom namespace and supply malicious event data. Because the asterisk user typically has broad privileges over the Asterisk platform, successful exploitation can lead to privilege escalation, full system compromise, and persistence.