CVE-2025-57819

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-57819 9.8

Sangoma · FreePBX · Added 2025-08-29 · Published 2025-08-28

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilitySangoma FreePBX Authentication Bypass Vulnerability

VendorSangoma

ProductFreePBX

Date added2025-08-29

Due date2025-09-19

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-288 CWE-89

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

NVD: FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-06-13 18:02 UTC

Wall time1.2s

Searches2

Component defaultno

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-57819
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
https://horizon3.ai/attack-research/vulnerabilities/cve-2025-57819/
https://www.greenbone.net/en/blog/cve-2025-57819-unauthenticated-rce-threatens-freepbx-systems-globally/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819

QC notes

warn component_extraction: Component 'FreePBX endpoint module versions prior to 15.0.66 (v15), 16.0.89 (v16), and 17.0.3 (v17)' matches or contains product name 'FreePBX' — no specific component identified

Hunting hypothesis agent

Monitor for unauthenticated HTTP requests targeting FreePBX endpoint module administrative interfaces with crafted Authorization headers enabling SQL injection and remote code execution.

Research details

ComponentFreePBX endpoint module versions prior to 15.0.66 (v15), 16.0.89 (v16), and 17.0.3 (v17)

PreconditionsFreePBX must be configured with AUTHTYPE webserver; Target must run FreePBX 15, 16, or 17 with endpoint module installed and administrative interface exposed to the network agent

DeliveryHTTP

Public PoCno

Advisoryhttps://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0)

SummaryAuthentication bypass in FreePBX endpoint module via insufficiently sanitized user-supplied data. When FreePBX uses AUTHTYPE webserver, HTTP Basic Authorization header password is never validated, allowing unauthenticated access to administrative interfaces. Chained with SQL injection (CWE-89) to achieve arbitrary database manipulation and remote code execution with root-level access. Active exploitation observed starting on or before August 21, 2025.

Tia coverage

First reported2026-05-22

First exploit report2026-05-20

Exploit report → KEV264 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.