PT-2025-50748 · Freepbx · Freepbx

Cold Z3Ro · Published 2025-12-11 · Updated 2025-12-15 · CVE-2024-58294

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX version 16

Description FreePBX version 16 contains an authenticated remote code execution issue in the API module. An attacker with valid session credentials can execute arbitrary commands. The issue is exploitable through the 'generatedocs' API endpoint by submitting crafted POST requests that inject bash commands, potentially leading to remote shell access. The generatedocs endpoint accepts POST requests with malicious payloads. The vulnerable parameter is not explicitly specified, but the attack involves bash command injection.

Recommendations Apply any available updates or patches for FreePBX version 16. Restrict access to the 'generatedocs' API endpoint. As a temporary workaround, consider disabling the API module until a patch is available.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-58294

Affected Products

Freepbx

References · 7

• 🔥 https://exploit-db.com/exploits/52031 · Exploit
• 🔥 https://youtube.com/watch?v=rqFJ0BxwlLI · Exploit
• https://osv.dev/vulnerability/CVE-2024-58294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58294 · Security Note
• https://t.me/cveNotify/145785 · Telegram Post
• https://vulncheck.com/advisories/freepbx-authenticated-remote-code-execution-via-api-module · Note
• https://freepbx.org · Note