CVE-2022-28005

CVE-2022-28005 is a critical vulnerability affecting the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker can exploit a directory traversal flaw to disclose cleartext credentials, then overwrite a 3CX service binary to achieve Remote Code Execution as NT AUTHORITY\SYSTEM on Windows. This vulnerability has a CVSS score of 9.8 (CRITICAL), indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, its high EPSS and FAUCET Risk Score suggest a notable potential for future exploitation.