CVE-2019-14935: 3cx

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and leading to privilege escalation because of a StartUp link.

Affected products

• 3cx 3cx: version 15 only

Published 2019-08-12. Last modified 2026-06-17.