CVE-2025-57819

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203	Issue Tracking Vendor Advisory
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h	Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sangoma:freepbx::::::::
	cpe:2.3:a:sangoma:freepbx::::::::
	cpe:2.3:a:sangoma:freepbx::::::::

History

02 Sep 2025, 14:48

Type	Values Removed	Values Added
CPE		cpe:2.3:a:sangoma:freepbx::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Sangoma Sangoma freepbx
References	~~() https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203 -~~	() https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203 - Issue Tracking, Vendor Advisory
References	~~() https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h -~~	() https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h - Vendor Advisory, Mitigation

28 Aug 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-28 17:15

Updated : 2025-09-02 14:48

NVD link : CVE-2025-57819

Mitre link : CVE-2025-57819

CVE.ORG link : CVE-2025-57819

JSON object : View

Products Affected

sangoma

freepbx

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2025-57819", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-28T17:15:36.790", "references": [{"url": "https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h", "tags": ["Vendor Advisory", "Mitigation"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3."}], "lastModified": "2025-09-02T14:48:31.737", "cisaActionDue": "2025-09-19", "cisaExploitAdd": "2025-08-29", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9143871-4B1B-4E24-BEC2-BFD90A93D22E", "versionEndExcluding": "15.0.66", "versionStartIncluding": "15.0"}, {"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA0527BD-AE80-4126-A72A-008EEC486381", "versionEndExcluding": "16.0.89", "versionStartIncluding": "16.0"}, {"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89857E91-C727-4043-8BCE-A2A089D6F720", "versionEndExcluding": "17.0.3", "versionStartIncluding": "17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com", "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "Sangoma FreePBX Authentication Bypass Vulnerability"}