PT-2025-42181 · Unknown · Freepbx Endpoint Manager

Published 2025-10-14 · Updated 2025-10-14 · CVE-2025-59051

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreePBX Endpoint Manager versions prior to 16.0.92 FreePBX Endpoint Manager versions prior to 17.0.6

Description The software includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. Insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. The vulnerable feature is accessible through the Endpoint Manager module.

Recommendations Update to FreePBX Endpoint Manager version 16.0.92 or later. Update to FreePBX Endpoint Manager version 17.0.6 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-59051

GHSA-QGJ3-F9GJ-98V9

Affected Products

Freepbx Endpoint Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-59051 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59051 · Vendor Advisory
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-qgj3-f9gj-98v9 · Note
• https://t.me/CVEtracker/34888 · Telegram Post
• https://twitter.com/CVEnew/status/1978198218501505303 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978246076126626086 · Twitter Post