PT-2025-35106 · Freepbx · Freepbx

Matthewljensen

·

Published

2025-08-28

·

Updated

2025-08-30

·

CVE-2025-57819

Report an issue
CVSS v4.0
10
VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

**Name of the Vulnerable Software and Affected Versions:**

FreePBX versions prior to 15.0.66

FreePBX versions prior to 16.0.89

FreePBX versions prior to 17.0.3

**Description:**

FreePBX is vulnerable due to insufficiently sanitized user-supplied data, allowing unauthenticated access to the FreePBX Administrator interface. This can lead to arbitrary database manipulation and remote code execution (RCE). The vulnerability is actively exploited in the wild, with over 6620 unpatched instances observed and at least 386 systems compromised as of August 29, 2025. Exploitation has been ongoing since August 21, 2025. The vulnerability allows attackers to bypass login protections, perform SQL injection, and achieve remote code execution. Approximately 85.9k vulnerable instances have been identified.

**Recommendations:**

Update to FreePBX version 15.0.66 or later.

Update to FreePBX version 16.0.89 or later.

Update to FreePBX version 17.0.3 or later.

Fix

RCE

Authentication Bypass Using an Alternate Path or Channel

SQL injection

Weakness Enumeration

CWE-288CWE-89

Related Identifiers

BDU:2025-10524
CVE-2025-57819

Affected Products

Freepbx