FreePBX CVE-2025-57819: Auth Bypass Leading to SQLi and RCE

Key Information Summary Vulnerability Overview Vulnerability Name: Authentication Bypass Leading to SQL Injection and RCE Severity: Critical (10.0/10) CVE ID: CVE-2025-57819 CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High Affected Versions FreePBX 15: < 15.0.66 (Fixed version: 15.0.66) FreePBX 16: < 16.0.89 (Fixed version: 16.0.89) FreePBX 17: < 17.0.3 (Fixed version: 17.0.3) Vulnerability Description Summary: Improperly sanitized user input data allows unauthorized access to FreePBX administrator interfaces, leading to arbitrary database operations and remote code execution. Details: Starting August 21, 2025, unauthorized users began accessing multiple FreePBX versions 16 and 17 systems directly connected to the public internet, exploiting validation/cleanup flaws in the "endpoint" module, ultimately gaining potential root privileges on target systems. Mitigation Measures Users should upgrade to the latest supported FreePBX versions (currently 15, 16, and 17) and verify that the installed "endpoint" module meets the minimum patch version requirements. Command-line update method: Affected Versions All supported FreePBX versions: 15, 16, and 17. EOL versions were not tested but may be affected. It is recommended to upgrade EOL versions to supported versions to ensure this vulnerability is patched. Indicators of Compromise Recent modification or deletion of the file The file should not exist on a normal system POST requests to in web server logs may indicate malicious traffic Calls to extension 9998 appearing in call logs and CDRs are suspicious (unless previously configured) Suspicious entries in the database table or other unknown user accounts

Goal Reached Thanks to every supporter — we hit 100%!

FreePBX CVE-2025-57819: Auth Bypass Leading to SQLi and RCE

More from this source