Scanning 3CX system via Rapid7

[Malyar]

Good afternoon.
We have implemented a vulnerability scanning system - Rapid7.
When scanning 3CX (v20, Linux, latest version), we obtained some very interesting results: 9,500 vulnerabilities, including a whole bunch of critical ones. (I’ve attached a screenshot.)
If we look by year, they date back to 2025 and earlier (all the way back to 2017).
As we understand it, are these some old leftovers from previous installations?
All vulnerabilities (categories 9-10) state:
"Configuration remediation steps:
Use `apt-get upgrade` to upgrade ******** to the latest version. "

But in that case, this contradicts what is written on the official website: https://www.3cx.com/docs/manual/installing-debian-linux-pbx/
"3CX created a Debian Linux ISO to make installation faster and management easier. You must dedicate your Debian Linux instance to 3CX.

* Do not install other packages or change the configuration.
* Do not install system updates via the command line! This is done by the 3CX system via updates after they have been tested!
* Any changes to the system will render your installation unsupported!".

In any case, we ran an apt full-upgrade on our test 3CX server, scanned again, and the results remained the same.
What do you recommend we do?
Maybe it would be easier to switch to Windows Server?

 

[NikosT_3CX]

@Malyar as a first step you can check our Security Change log here : https://www.3cx.com/blog/change-log/pbx-security-updates/
As a second step, are Automatic Updates enabled on the PBX side ?
This is how the security updates are installed on the background of the PBX from our side.

 

[Malyar]

@Malyar as a first step you can check our Security Change log here : https://www.3cx.com/blog/change-log/pbx-security-updates/
As a second step, are Automatic Updates enabled on the PBX side ?
This is how the security updates are installed on the background of the PBX from our side.

Automatic updates are not enabled. Isn’t it enough that we manually install new versions via the web console (release) when they become available?
My question wasn’t about the server not receiving updates, but about the fact that the server (apparently) still has old versions of some system files, which Rapid7 is detecting.

 

[bitn2]

Automatic updates are not enabled. Isn’t it enough that we manually install new versions via the web console (release) when they become available?
My question wasn’t about the server not receiving updates, but about the fact that the server (apparently) still has old versions of some system files, which Rapid7 is detecting.

No, Linux updates are only installed with automatic option.

 

[Malyar]

No, Linux updates are only installed with automatic option.

Yes, I’ve looked into that, thanks.

But the automatic update option isn’t really suitable for us because we have failover configured. And the administrator won’t always be able to switch from the backup server to the primary one on weekends.

But I’m also curious as to why leftovers from previous 3CX updates (which Rapid7 identifies as vulnerabilities) might still be present in the system.

 

[bitn2]

Yes, I’ve looked into that, thanks.
View attachment 51466
But the automatic update option isn’t really suitable for us because we have failover configured. And the administrator won’t always be able to switch from the backup server to the primary one on weekends.

But I’m also curious as to why leftovers from previous 3CX updates (which Rapid7 identifies as vulnerabilities) might still be present in the system.

You can just switch automatic on for some hours and off again to update the linux stuff. Why are there some leftovers, i dont know.