PT-2025-42182 · Asterisk+1 · Asterisk+1

Published 2025-10-14 · Updated 2026-01-20 · CVE-2025-59429

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.68.39 FreePBX versions prior to 17.0.18.38

Description FreePBX, an open source GUI for managing Asterisk, contains a reflected cross-site scripting issue on the Asterisk HTTP Status page. The page is exposed by FreePBX and is accessible on version 16 via any bound IP address at port 8088, while on version 17, it is bound to localhost by default. Unauthenticated attackers can obtain cookies from logged-in users, potentially allowing them to hijack an administrative user's session. Successful exploitation could grant attackers control over the FreePBX admin interface, enabling access to sensitive data, modification of system configurations, creation of backdoor accounts, and service disruption. The Asterisk HTTP Status page is a component used for monitoring the status of the Asterisk application.

Recommendations Update to FreePBX version 16.0.68.39 or later. Update to FreePBX version 17.0.18.38 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-59429

GHSA-C8G7-475J-FWCC

Affected Products

Asterisk

Freepbx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59429.json · Exploit
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-c8g7-475j-fwcc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59429 · Security Note
• https://twitter.com/CVEnew/status/1978198214000992758 · Twitter Post
• https://t.me/CVEtracker/34892 · Telegram Post
• https://t.me/cveNotify/149263 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1978243516233826814 · Twitter Post