This is why you need to patch

[daveataylor]

Just come across this off the 3CX Facebook group (3CX Admin's Lounge)

Pwning 3CX Phone Management Backends from the Internet​

https://medium.com/@frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88

Does anyone know if it's possible to change the WebAdmin port so that we can also block on the firewall connections to this port?

 

[ChrisC_3CX]

I think we should first focus on the last paragraph which clearly states that this has been fixed in v18 build 18.0.3.461 and that the very first thing to do if not done already is update to it.

Regarding the WebAdmin, are you talking about the port required to reach the Management Console? If yes that's the https port that also used for other 3CX functionality so we do not recommend restricting it on the firewall.

 

[Alphabetic]

Im assuming this was the security patch that needed installing ASAP then

 

[NickD_3CX]

Im assuming this was the security patch that needed installing ASAP then

That would be correct.

 

[Saqqara]

Congrats to 3CX for fixing the issue so quickly, some vendors will take ages to resolve security issues when there have been informed.