FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-57819 | Unauthenticated SQL Injection and Auth Bypass Leading to RCE in Sangoma FreePBX 15/16/17 FreePBX, Sangoma's open-source web-based GUI for managing PBX systems, is vulnerable in versions 15, 16, and 17 endpoint releases due to insufficiently sanitized user-supplied data (SQL injection, CWE-89, combined with an authentication bypass, CWE-288). An unauthenticated, remote attacker can exploit the flaw without any privileges or user interaction to gain unauthorized access to the FreePBX Administrator interface. From there, the attacker can arbitrarily manipulate the database and ultimately achieve remote code execution on the server. Deployments running affected endpoint versions of FreePBX 15, 16, or 17 are impacted, particularly those with the admin web interface reachable from the internet. The flaw is being actively exploited in the wild: it was added to CISA's KEV catalog on 2025-08-29, a public proof-of-concept is available from watchTowr Labs, and EPSS places it at 85.5% probability of exploitation in the next 30 days (100th percentile). Do: Immediately update the FreePBX endpoint package to version 15.0.66, 16.0.89, or 17.0.3 as applicable for each major version in use; federal agencies must follow the CISA BOD 22-01 required actions. Restrict or allowlist access to the FreePBX Administrator web interface at the firewall/reverse proxy level, and review logs for unauthenticated administrator access, unexpected database changes, or uploaded webshells indicating compromise. Treat this as an actively exploited vulnerability given its KEV listing, public PoC, and high EPSS score. | 10.0 | 85% | KEV PoC |
| masshundreds of thousands of PBX deployments, with tens of thousands of admin web interfaces likely internet-exposed | |
| CVE-2025-61678 +1 in the same advisory: …61675 | Authenticated Arbitrary File Upload RCE in FreePBX Endpoint Manager CVE-2025-61678 is an authenticated arbitrary file upload vulnerability (CWE-434) in the FreePBX Endpoint Manager module, which is used to provision telephony endpoints on FreePBX PBX servers. An attacker who is authenticated (the advisory notes only a known username is required) sends a crafted upload request in which the fwbrand parameter is manipulated, allowing the upload path to be changed so that arbitrary files are written to attacker-controlled locations on the server. By placing a webshell in a web-reachable directory, the attacker can escalate the file upload into remote code execution on the PBX host. Affected deployments are FreePBX 16 systems running Endpoint Manager versions before 16.0.92 and FreePBX 17 systems running versions before 17.0.6. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 50.2% probability of exploitation within 30 days (99th percentile), and the fix shipped as part of FreePBX's recent batch of critical RCE-enabling patches, so remediation should be treated as urgent. Do: Upgrade the Endpoint Manager module to version 16.0.92 on FreePBX 16 or 17.0.6 on FreePBX 17 via Module Admin/fwconsole. Because exploitation requires authentication with a known username, restrict and review administrative access to the FreePBX web UI and audit admin accounts (particularly given the related AUTHTYPE bypass and SQLi fixes in the same patch batch), and check upload and firmware paths for unexpected PHP or webshell files. | 8.6 | 50% |
| largelikely tens of thousands to low hundreds of thousands of PBX systems (estimate; exact module install counts unpublished) | ||
| CVE-2025-66039 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23. NVD description · AI analysis pending | 9.3 | 3% |
| — |
Full article575 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 15, 2025Vulnerability / Software Security
Multiple security vulnerabilities have been disclosed in the open-source private branch exchange (PBX) platform FreePBX, including a critical flaw that could result in an authentication bypass under certain configurations.
The shortcomings, discovered by Horizon3.ai and reported to the project maintainers on September 15, 2025, are listed below -
- CVE-2025-61675 (CVSS score: 8.6) - Numerous authenticated SQL injection vulnerabilities impacting four unique endpoints (basestation, model, firmware, and custom extension) and 11 affected parameters that enable read and write access to the underlying SQL database
- CVE-2025-61678 (CVSS score: 8.6) - An authenticated arbitrary file upload vulnerability that allows an attacker to exploit the firmware upload endpoint to upload a PHP web shell after obtaining a valid PHPSESSID and run arbitrary commands to leak the contents of sensitive files (e.g., "/etc/passwd")
- CVE-2025-66039 (CVSS score: 9.3) - An authentication bypass vulnerability that occurs when the "Authorization Type" (aka AUTHTYPE) is set to "webserver," allowing an attacker to log in to the Administrator Control Panel via a forged Authorization header
It's worth mentioning here that the authentication bypass is not vulnerable in the default configuration of FreePBX, given that the "Authorization Type" option is only displayed when the three following values in the Advanced Settings Details are set to "Yes":
- Display Friendly Name
- Display Readonly Settings, and
- Override Readonly Settings
However, once the prerequisite is met, an attacker could send crafted HTTP requests to sidestep authentication and insert a malicious user into the "ampusers" database table, effectively accomplishing something similar to CVE-2025-57819, another flaw in FreePBX that was disclosed as having been actively exploited in the wild in September 2025.
"These vulnerabilities are easily exploitable and enable authenticated/unauthenticated remote attackers to achieve remote code execution on vulnerable FreePBX instances," Horizon3.ai security researcher Noah King said in a report published last week.
The issues have been addressed in the following versions -
- CVE-2025-61675 and CVE-2025-61678 - 16.0.92 and 17.0.6 (Fixed on October 14, 2025)
- CVE-2025-66039 - 16.0.44 and 17.0.23 (Fixed on December 9, 2025)
In addition, the option to choose an authentication provider has now been removed from Advanced Settings and requires users to set it manually through the command-line using fwconsole. As temporary mitigations, FreePBX has recommended that users set "Authorization Type" to "usermanager," set "Override Readonly Settings" to "No," apply the new configuration, and reboot the system to disconnect any rogue sessions.
"If you did find that web server AUTHTYPE was enabled inadvertently, then you should fully analyze your system for signs of any potential compromise," it said.
Users are also displayed a warning on the dashboard, stating "webserver" may offer reduced security compared to "usermanager." For optimal protection, it's advised to avoid using this authentication type.
"It's important to note that the underlying vulnerable code is still present and relies on authentication layers in front to provide security and access to the FreePBX instance," King said. "It still requires passing an Authorization header with a basic Base64-encoded username:password."
"Depending on the endpoint, we noticed a valid username was required. In other cases, such as the file upload shared above, a valid username is not required, and you can achieve remote code execution with a few steps, as outlined. It is best practice not to use the authentication type webserver as it appears to be legacy code."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/12/freepbx-authentication-bypass-exposed.html