Latest Sangoma FreePBX vulnerability #

Sangoma has disclosed multiple flaws in certain versions of its FreePBX telephony software. These flaws include an authentication bypass of the Administrator Control Panel (ACP). This vulnerability can lead to arbitrary database manipulation and remote code execution (RCE) because the commercial endpoint module insufficiently sanitizes user-supplied data. Successful exploitation could allow a remote, unauthenticated adversary to gain root access to the target system. This vulnerability has been designated CVE-2025-57819 and has been rated critical with a CVSS score of 9.8.

There is evidence that this vulnerability is being actively exploited in the wild.

    The following versions are affected

    • FreePBX 15.x versions prior to 15.0.66
    • FreePBX 16.x versions prior to 16.0.89
    • FreePBX 17.x versions prior to 17.0.3
    • Note, end of life (EOL) versions are untested for the vulnerability and may be affected. Therefore, it is advised to upgrade all EOL versions to a supported version.

    What is the impact? #

    Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

    Are updates or workarounds available? #

    Users are encouraged to update to the latest version as quickly as possible:

    • FreePBX 15.x upgrade to version 15.0.66 or later
    • FreePBX 16.x upgrade to version 16.0.89 or later
    • FreePBX 17.x upgrade to version 17.0.3 or later
    • FreePBX end-of-life (EOL) versions upgrade to a supported version

    How to find potentially vulnerable systems with runZero #

    From the Software Inventory, use the following query to locate potentially impacted assets:

    ((vendor:=FreePBX AND product:=PBX) OR (vendor:=Sangoma AND product:=FreePBX)) AND (version:>0 AND (version:<"15.0.66(%)" OR version:<"16.0.89(%)" OR version:<"17.0.3(%)"))

    Written by Matthew Kienow

    Matthew Kienow is a software engineer and security researcher. Matthew previously worked on the Recog recognition framework, AttackerKB as well as Metasploit's MSF 5 APIs. He has also designed, built, and successfully deployed many secure software solutions; however, often he enjoys breaking them instead. He has presented his research at various security conferences including DerbyCon, Hack In Paris, and CarolinaCon. His research has been cited by CSO, Threatpost and SC Magazine.

    More about Matthew Kienow
    Subscribe Now

    Get the latest news and expert insights delivered in your inbox.

    Welcome to the club! Your subscription to our newsletter is successful.

    See Results in Minutes

    See & secure your total attack surface. Even the unknowns & unmanageable.