PT-2025-35106 · Freepbx · Freepbx

Matthewljensen · Published 2025-08-28 · Updated 2026-06-13 · CVE-2025-57819

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 15.0.66 FreePBX versions prior to 16.0.89 FreePBX versions prior to 17.0.3

Description FreePBX is an open-source web-based graphical user interface. A critical issue exists in the "endpoint" module where insufficiently sanitized user-supplied data allows unauthenticated attackers to bypass authentication controls. This flaw enables an attacker to perform SQL injection, which is a technique used to manipulate database queries, leading to arbitrary database manipulation and remote code execution with SYSTEM-level privileges. There are reports of this issue being actively exploited in the wild.

Recommendations Update to version 15.0.66 for FreePBX 15. Update to version 16.0.89 for FreePBX 16. Update to version 17.0.3 for FreePBX 17. As a temporary workaround, restrict access to the "endpoint" module to minimize the risk of exploitation.

Exploit

Fix

RCE

Authentication Bypass Using an Alternate Path or Channel

SQL injection

Weakness Enumeration

CWE-288

CWE-89

Related Identifiers

BDU:2025-10524

CVE-2025-57819

GHSA-M42G-XG4C-5F3H

Affected Products

Freepbx

References · 141

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57819.json · Exploit
• 🔥 https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57819 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57819 · Vendor Advisory
• https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10524 · Security Note
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h · Security Note, Vendor Advisory
• https://github.com/FreePBX/security-reporting · Note
• https://twitter.com/TweetThreatNews/status/1962963945582420121 · Twitter Post
• https://reddit.com/r/MSP2DAY/comments/1n8hx94/kritieke_freepbx_zeroday_snel_patchen · Reddit Post
• https://t.me/RNetsec/21988 · Telegram Post
• https://t.me/proxy_bar/2740 · Telegram Post
• https://reddit.com/r/MSP2DAY/comments/1na55rk/kritieke_zeroday_bedreigt_freepbx_onmiddellijk · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1n3xv8j/top_10_trending_cves_30082025 · Reddit Post
• https://twitter.com/offseq/status/1961240123636355159 · Twitter Post