FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 15.0.66, 16.0.89, 17.0.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FreePBX, an open-source web-based phone system management interface, is affected, specifically its 15, 16, and 17 release lines. An unauthenticated attacker could bypass login to gain administrator access, then manipulate the database and execute arbitrary code on the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- FreePBX endpoint
fixed in 15.0.66; fixed in 16.0.89; fixed in 17.0.3
References 2
GitHub · FreePBX/security-reporting
community.freepbx.org
Questions about CVE-2025-57819
What does this mean?
The FreePBX Administrator control panel can be reached without logging in. An attacker who reaches it can change the database and run commands on the server, possibly with root rights.Source: community.freepbx.org, github.com
Am I affected, and how do I check?
The flaw is in the commercial endpoint module on FreePBX 15, 16, and 17 when it is installed and unpatched. It matters most where the Administrator panel is exposed to the public internet or where IP filtering or ACLs are weak. Check the installed endpoint module version against the fixed versions 15.0.66, 16.0.89, and 17.0.3.Source: community.freepbx.org, github.com
What should I do about it?
Update the endpoint module to 15.0.66, 16.0.89, or 17.0.3, whichever matches your major version. Until then, limit access to the FreePBX Administrator with the Firewall module so only known trusted hosts can reach it.Source: community.freepbx.org, github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-08-29, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data