CVE-2026-46376: FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

Synopsis

Hard-coded credentials in FreePBX's User Control Panel (UCP) allow unauthenticated network attackers to log in using initial template credentials that ship with the product. Reachable over the network with no authentication or user interaction, successful exploitation grants attacker access to UCP user accounts and the data they expose, with high impact to confidentiality and integrity of those accounts. Note: although the CVE description states the issue is fixed in 16.0.45 and 17.0.7, no fix version is published in the record, so HarborGuard tracks the advisory for confirmed patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  Attacker must reach the FreePBX UCP interface over the network, typically HTTP(S) on the PBX host.

• AuthenticationNot required

  No credentials are needed because the attacker logs in using hard-coded initial template credentials.

• Victim interactionNot required

  Exploitation is fully automated against the UCP endpoint with no user action required.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, requiring only that the admin never rotated the initial template credentials.

Blast Radius

• Unauthenticated login to UCP user accounts whose initial template credentials were not rotated.
• Reads voicemail, call history, contacts, and other UCP-exposed personal communication data (VC:H).
• Modifies UCP user settings, forwarding rules, and preferences, enabling call redirection or further social engineering (VI:H).
• Provides a foothold for pivoting into the broader FreePBX administrative surface from a logged-in user context.