CVE-2025-57819

FreePBX, Sangoma's open-source web-based GUI for managing PBX systems, is vulnerable in versions 15, 16, and 17 endpoint releases due to insufficiently sanitized user-supplied data (SQL injection, CWE-89, combined with an authentication bypass, CWE-288). An unauthenticated, remote attacker can exploit the flaw without any privileges or user interaction to gain unauthorized access to the FreePBX Administrator interface. From there, the attacker can arbitrarily manipulate the database and ultimately achieve remote code execution on the server. Deployments running affected endpoint versions of FreePBX 15, 16, or 17 are impacted, particularly those with the admin web interface reachable from the internet. The flaw is being actively exploited in the wild: it was added to CISA's KEV catalog on 2025-08-29, a public proof-of-concept is available from watchTowr Labs, and EPSS places it at 85.5% probability of exploitation in the next 30 days (100th percentile).

What to do: Immediately update the FreePBX endpoint package to version 15.0.66, 16.0.89, or 17.0.3 as applicable for each major version in use; federal agencies must follow the CISA BOD 22-01 required actions. Restrict or allowlist access to the FreePBX Administrator web interface at the firewall/reverse proxy level, and review logs for unauthenticated administrator access, unexpected database changes, or uploaded webshells indicating compromise. Treat this as an actively exploited vulnerability given its KEV listing, public PoC, and high EPSS score.