CVE-2025-57819

FreePBX endpoint

Published 28 Aug 2025 · updated 26 Sept 2026 · Analyzed

10.0 Critical · CVSS 4.0, github.com

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 29 Aug 2025, with a remediation deadline of 19 Sept 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

References

community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203 · Issue Tracking, Vendor Advisory
github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h · Mitigation, Vendor Advisory
github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819 · Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819 · US Government Resource