CVE-2023-27362: 
3CX 3CXPhone vulnerability analysis and mitigation

3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability (CVE-2023-27362) allows local attackers to escalate privileges on affected installations of 3CX. The vulnerability exists within the configuration of OpenSSL, where the product loads an OpenSSL configuration file from an unsecured location. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. The issue was discovered in April 2023 and publicly disclosed in August 2023 (ZDI Advisory).

The specific vulnerability stems from the OpenSSL configuration file being loaded from an unsecured location. This security flaw is tracked as CWE-427 (Uncontrolled Search Path Element). The vulnerability has been assigned a CVSS v3.0 base score of 7.0 HIGH (Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) (ZDI Advisory).

If successfully exploited, an attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. This means an attacker could gain complete control over the affected system, potentially compromising sensitive data and system resources (ZDI Advisory).

3CX has addressed this vulnerability by releasing Update 8 (v18-u8) which includes fixes for this security issue. Users are advised to upgrade to this version to protect against potential exploitation (3CX Blog).