PT-2025-37763

CVE-2025-55211

Published

2025-09-15

Updated

2025-10-17

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreePBX versions 17.0.19.11 through 17.0.20

Description FreePBX is a web-based graphical user interface. Authenticated users of the Administrator Control Panel (ACP) can execute arbitrary shell commands by manipulating the framework module's language settings. This allows malicious actors to potentially compromise the system.

Recommendations Update to version 17.0.21 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers

CVE-2025-55211