FreePBX Authenticated Music RCE via mpg123/Asterisk (CVE-2026-73662)

Vulnerability Overview Vulnerability Name: Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files CVE ID: CVE-2026-73662 CVSS v4 Base Score: 7.5 (High) CVSS v4 Base Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/VC:H/SC:H/CR:H/IR:H/AR:H/MAV:N/MAC:L

Goal Reached Thanks to every supporter — we hit 100%!

FreePBX Authenticated Music RCE via mpg123/Asterisk (CVE-2026-73662)

More from this source