CRITICAL

CVE-2025-57819

Sangoma Freepbx 2025-08-28 CVSS v3.1

CVSS

9.8

KEV

Description

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

Summary dbcve.org

FreePBX endpoints versions 15, 16, and 17 contain a critical authentication bypass vulnerability caused by insufficient input sanitization. Unauthenticated attackers can gain FreePBX Administrator access, enabling arbitrary database manipulation and remote code execution.

Mitigation

Immediately upgrade FreePBX endpoints to version 15.0.66, 16.0.89, or 17.0.3 (or later) to remediate the vulnerability. Until patched, restrict network access to FreePBX management interfaces.

Proof of Concept

Weakness (CWE)

CWE-89 SQL Injection

CWE-288

EPSS Score

85.46%

Probability of exploitation in next 30 days

99.7th percentile

References

https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203 Issue Tracking, Vendor Advisory https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h Mitigation, Vendor Advisory https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819 Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE