CVE-2025-57819

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 15.0.66 FreePBX versions prior to 16.0.89 FreePBX versions prior to 17.0.3

Description FreePBX is an open-source web-based graphical user interface. The endpoint module contains an authentication bypass and SQL injection flaw caused by insufficiently sanitized user-supplied data. This allows unauthenticated attackers to bypass login controls, manipulate the database, and achieve remote code execution with SYSTEM-level privileges. Real-world incidents of active exploitation have been detected.

Recommendations Update FreePBX version 15 to 15.0.66 or later. Update FreePBX version 16 to 16.0.89 or later. Update FreePBX version 17 to 17.0.3 or later. As a temporary mitigation, restrict access to the endpoint module to minimize the risk of exploitation.