TI-2025-35702 Aliases CVE-2025-57819

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

CRITICAL 100Exploited in the wildCWE-288Published 2025-08-28 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass, SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288 and CWE-89.

Summary

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

Why it matters now

Exploitation Active In CISA KEV since 2025-08-29CISA due date 2025-09-19

EPSS 0.95213 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed endpoint (FreePBX): 15.0.66, 16.0.89, 17.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FreePBX	endpoint	before 15.0.66; before 16.0.89; before 17.0.3	15.0.66, 16.0.89, 17.0.3	Patch available	CNA

endpoint VendorFreePBX Affected before 15.0.66; before 16.0.89; before 17.0.3 Fixed in 15.0.66, 16.0.89, 17.0.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sangoma:freepbx::::::::	15.0 to before 15.0.66; 16.0 to before 16.0.89; 17.0 to before 17.0.3	Vulnerable	Sangoma

cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:* Versions 15.0 to before 15.0.66; 16.0 to before 16.0.89; 17.0 to before 17.0.3 Vulnerable ·Sangoma

Remediation

Fix · CNA endpoint (FreePBX) Fixed in 15.0.66, 16.0.89, 17.0.3

Timeline

2025-08-29 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2025-57819

References

Exploit 1

https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819

Advisory 2

TI-2025-39763 FreePBX Administration GUI is Vulnerable to Authenticated Command Injection KEVCVSS 4.0HIGH 8.6
TI-2024-38391 FreePBX 16 Authenticated Remote Code Execution via API Module CVSS 4.0HIGH 8.7
TI-2014-06023 htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface… CVSS 2.0HIGH 10.0
TI-2025-36981 FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page CVSS 4.0HIGH 8.5
TI-2025-38110 FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter CVSS 4.0HIGH 8.6
TI-2025-38107 FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters CVSS 4.0HIGH 8.6

See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences