portbuster1337/CVE-2026-46376

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script (poc.py) that actively exploits CVE-2026-46376 by sending HTTP requests to a target FreePBX instance. It attempts to log into the UCP using hard-coded credentials, bypass an unlock key, and test default admin credentials. The README documents the vulnerability and usage.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script that demonstrate the CVE-2026-46376 vulnerability by attempting UCP login with hard-coded credentials, an unlock key bypass, and default admin credential testing. All actions are directed at the stated target and are consistent with legitimate security testing. No concealed payloads, persistence mechanisms, credential exfiltration to third parties, or unrelated remote access were observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareFreePBXFreePBX userman module
Attack typesUse of Hard-coded CredentialsAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable Python code (poc.py) that actively sends crafted HTTP requests to a target to gain unauthorized access using hard-coded credentials, an unlock key bypass, and default admin credentials. The README explicitly labels it as a PoC and describes exploitation steps. This is an exploit, not a scanner, because it attempts to perform the actual unauthorized login and access, not merely detect the vulnerability.

poc.py:1-319README.md:36-41README.md:60-62

Requirements

  • Target must be running an affected FreePBX version (15.0.42+, userman <= 16.0.44, or userman <= 17.0.6) and the UCP generic template setup must have been performed by an administrator.README.md:11README.md:24poc.py:32-36
  • The target's UCP interface must be accessible over the network.poc.py:111-115

Observed behavior

  • Sends a GET request to the target root to check reachability.poc.py:90
  • Fetches /admin/config.php to extract the FreePBX version string and determine if it falls within the affected range.poc.py:98-99
  • Checks if the UCP interface is present by requesting /ucp/index.php and searching for 'User Control Panel' in the response.poc.py:112-113
  • Attempts to log into the UCP by POSTing the hard-coded credentials (FreePBXUCPTemplateCreator / 1a2b3c@fd48jshs03123ld) to /ucp/ajax.php with module=User&command=login.poc.py:141-154
  • Attempts an unlock key bypass by iterating templateid values (0-5) in a GET request to /ucp/index.php?unlockkey=test&templateid=<tid> and checking for authenticated page indicators.poc.py:177-193
  • Attempts to log into the admin panel (/admin/config.php) using a list of common default credentials (admin/admin, admin/password, maint/password, ampuser/amp109).poc.py:212-232
  • Reports the target as VULNERABLE if any exploit method succeeds.poc.py:304-305
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hard Coded Credentials
FreePBXUCPTemplateCreator / 1a2b3c@fd48jshs03123ldCredentials used in the PoC to demonstrate the vulnerability; they are the subject of the CVE and are not hidden or used for unrelated access.poc.py:24-25
Default Admin Credential List
admin/admin, admin/password, maint/password, ampuser/amp109Common default credentials tested against the admin panel as part of the PoC's method 3; standard for security testing tools.poc.py:26-31
Network Request
POST /ucp/ajax.php with module=User&command=loginThe primary exploit request that attempts login with the hard-coded credentials; directed only at the user-supplied target.poc.py:140-154
Network Request
GET /ucp/index.php?unlockkey=test&templateid=<0-5>Attempts an unlock key bypass; directed only at the user-supplied target.poc.py:177-183
Network Request
POST /admin/config.php with default credentialsAttempts admin panel login with common defaults; directed only at the user-supplied target.poc.py:212-222
Review boundaries

What the analysis did not establish

  • The evidence includes only two text files (README.md and poc.py). No binary files, network captures, or execution logs are provided. The analysis is based solely on static review of the source code and documentation; the code was not executed, and its actual effectiveness is not verified.
  • Only the two text files (README.md and poc.py) were reviewed; no binary or other files were present in the artifact.
  • The review does not assess whether the PoC actually works or is safe to run; it only evaluates the presence of backdoor or deceptive behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1