TT-CSIRT-415.3.4.23: 3CX Security Advisory

VoIP/IP PBX solutions provider 3CX has released a security advisory concerning the compromise of their desktop app for both Windows and MacOS in a supply chain attack. 3CX recommends that users migrate to the PWA app in the interim until the desktop apps are fixed. The PWA app is web-based and is unaffected by the supply chain attack.

TT-CSIRT encourages administrators to review the following releases and take the necessary actions immediately:

• 3CX Advisory: https://www.3cx.com/blog/news/desktopapp-security-alert/
• Fortinet Blog: https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised