CVE-2022-28005

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server (via /Electron/download directory traversal in conjunction with a path component that uses backslash characters), leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. NOTE: this issue exists because of an incomplete fix for CVE-2022-48482.

• CWE-522

• https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88
• https://www.3cx.com/blog/change-log/phone-system-change-log/Release Notes, Vendor Advisory
• https://www.3cx.com/blog/releases/v18-security-hotfix/Release Notes, Vendor Advisory
• https://www.3cx.com/blog/releases/v18-update-3-final/Release Notes, Vendor Advisory
• https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88
• https://www.3cx.com/blog/change-log/phone-system-change-log/Release Notes, Vendor Advisory
• https://www.3cx.com/blog/releases/v18-security-hotfix/Release Notes, Vendor Advisory
• https://www.3cx.com/blog/releases/v18-update-3-final/Release Notes, Vendor Advisory

Published

May 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-27991Online Banking System in PHP v1 was discovered to contain mu…6.5
• CVE-2022-27992Zoo Management System v1.0 was discovered to contain a SQL i…8.8
• CVE-2022-2800A vulnerability, which was classified as problematic, has be…6.1
• CVE-2022-28000Car Rental System v1.0 was discovered to contain a SQL injec…8.8
• CVE-2022-28001Movie Seat Reservation v1 was discovered to contain a SQL in…9.8
• CVE-2022-28002Movie Seat Reservation v1 was discovered to contain an unaut…7.5
• CVE-2022-28006Attendance and Payroll System v1.0 was discovered to contain…8.8
• CVE-2022-28007Attendance and Payroll System v1.0 was discovered to contain…8.8
• CVE-2022-28008Attendance and Payroll System v1.0 was discovered to contain…8.8
• CVE-2022-28009Attendance and Payroll System v1.0 was discovered to contain…8.8
• CVE-2022-2801A vulnerability, which was classified as critical, was found…9.8
• CVE-2022-28010Attendance and Payroll System v1.0 was discovered to contain…8.8