3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in…
Priority HIGH 69Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 of the 3CX DesktopApp Electron macOS application.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04373 91st percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:3cx:3cx:18.11.1213:*:*:*:*:macos:*:* | 18.11.1213 | Vulnerable | 3CX |
| cpe:2.3:a:3cx:3cx:18.12.402:*:*:*:*:macos:*:* | 18.12.402 | Vulnerable | 3CX |
| cpe:2.3:a:3cx:3cx:18.12.407:*:*:*:*:macos:*:* | 18.12.407 | Vulnerable | 3CX |
| cpe:2.3:a:3cx:3cx:18.12.407:*:*:*:*:windows:*:* | 18.12.407 | Vulnerable | 3CX |
| cpe:2.3:a:3cx:3cx:18.12.416:*:*:*:*:macos:*:* | 18.12.416 | Vulnerable | 3CX |
| cpe:2.3:a:3cx:3cx:18.12.416:*:*:*:*:windows:*:* | 18.12.416 | Vulnerable | 3CX |
- cpe:2.3:a:3cx:3cx:18.11.1213:*:*:*:*:macos:*:* Versions 18.11.1213 Vulnerable ·3CX
- cpe:2.3:a:3cx:3cx:18.12.402:*:*:*:*:macos:*:* Versions 18.12.402 Vulnerable ·3CX
- cpe:2.3:a:3cx:3cx:18.12.407:*:*:*:*:macos:*:* Versions 18.12.407 Vulnerable ·3CX
- cpe:2.3:a:3cx:3cx:18.12.407:*:*:*:*:windows:*:* Versions 18.12.407 Vulnerable ·3CX
- cpe:2.3:a:3cx:3cx:18.12.416:*:*:*:*:macos:*:* Versions 18.12.416 Vulnerable ·3CX
- cpe:2.3:a:3cx:3cx:18.12.416:*:*:*:*:windows:*:* Versions 18.12.416 Vulnerable ·3CX
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-29059
- 2026-10-03 Alias added: GHSA-m2q7-9c76-qc45
References
Exploit 4
- https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised
- https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
- https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
- https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
More 3cx vulnerabilities
- TI-2022-24062 3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated… CVSS 3.1HIGH 7.5
- TI-2022-10842 An issue was discovered in the 3CX Phone System Management Console prior to version 18… CVSS 3.1CRITICAL 9.8
- TI-2023-27314 The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL… CVSS 3.1CRITICAL 9.8
- TI-2022-24063 3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote… CVSS 3.1HIGH 7.5
- TI-2021-20577 The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application… CVSS 3.1CRITICAL 9.1
- TI-2019-09872 An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002… CVSS 3.0HIGH 7.5
Sources
- CVE-2023-29059 · CVE Program
- CVE-2023-29059 · NVD
- FIRST EPSS
- GHSA-m2q7-9c76-qc45 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences