PT-2025-35106 · Freepbx · Freepbx

Matthewljensen · Published 2025-08-28 · Updated 2026-03-15 · CVE-2025-57819

Positive Technologies · (AI Summary)

CVSS v4.0

10

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions FreePBX versions 15.0.0 through 17.0.3

Description FreePBX is vulnerable to an authentication bypass due to insufficient sanitization of user-supplied data. This allows unauthenticated access to the FreePBX Administrator interface, leading to arbitrary database manipulation and remote code execution (RCE). Exploitation of this issue has been observed in the wild since August 21, 2025, with over 6620 unpatched instances and at least 386 compromised systems reported as of August 29, 2025. Attackers have been observed deploying web shells, such as "modular.php," to gain persistent access and potentially install backdoors like PAM. The vulnerability allows attackers to achieve SYSTEM-level privileges without valid credentials. The /api/v1/login endpoint is potentially affected, allowing unauthorized access. The vulnerability stems from improper handling of input to the database, potentially through SQL injection.

Recommendations Update to FreePBX version 15.0.66 or later. Update to FreePBX version 16.0.89 or later. Update to FreePBX version 17.0.3 or later.

Exploit

Fix

RCE

SQL injection

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-89

CWE-288

Related Identifiers

BDU:2025-10524

CVE-2025-57819

GHSA-M42G-XG4C-5F3H

Affected Products

Freepbx

References · 137

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57819.json · Exploit
• 🔥 https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57819 · Security Note
• https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57819 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10524 · Security Note
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h · Security Note, Vendor Advisory
• https://github.com/FreePBX/security-reporting · Note
• https://twitter.com/CyberWarship/status/1972595708906684455 · Twitter Post
• https://twitter.com/transilienceai/status/1962385929303179656 · Twitter Post
• https://t.me/RNetsec/21988 · Telegram Post
• https://t.me/cveNotify/135243 · Telegram Post
• https://reddit.com/r/MSP2DAY/comments/1nbtsu3/kritieke_freepbx_zeroday_update_nu · Reddit Post
• https://leakix.net/search?q=%2Bplugin%3AFreePBXPlugin&scope=leak · Reddit Post
• https://twitter.com/TechNadu/status/1961807242497597692 · Twitter Post