PT-2024-35778 · Freepbx · Freepbx

Hyp164D1 · Published 2024-12-02 · Updated 2025-09-23 · CVE-2024-53564

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX version 17.0.19.17

Description A vulnerability was discovered in FreePBX, allowing high-privilege administrators to insert unwanted files due to a lack of verification of the type of uploaded files. This issue can be exploited for remote code execution. The vulnerability requires authentication, which may lower its priority, but it still needs to be addressed.

Recommendations For FreePBX version 17.0.19.17, patch immediately and review uploaded files for malicious content. Additionally, audit admin access to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the /module admin/upload.php endpoint until a patch is available.

Fix

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

CVE-2024-53564

Affected Products

Freepbx

References · 13

• https://osv.dev/vulnerability/CVE-2024-53564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53564 · Security Note
• https://t.me/cvenotify/106848 · Telegram Post
• https://t.me/cvedetector/11809 · Telegram Post
• https://gist.github.com/hyp164D1/490732de230edf97423f6d95b0d2f903 · Note
• https://twitter.com/CVEnew/status/1863649279426040240 · Twitter Post
• https://t.me/cveNotify/136144 · Telegram Post
• https://twitter.com/oktsec/status/1863714334649598152 · Twitter Post
• https://t.me/cvenotify/102958 · Telegram Post
• https://reddit.com/r/freepbx/comments/1hhirj3/cve202453564 · Reddit Post
• https://gist.github.com/hyp164D1/d419bdf3e7e352088a21631d0f452a8c · Note
• https://t.me/cvenotify/102889 · Telegram Post
• https://t.me/cvenotify/106853 · Telegram Post