Executive brief
FreePBX is a popular open-source web interface used to manage business phone systems (VoIP). A critical security flaw allows unauthorized individuals to bypass login screens and gain full administrative control over the phone system. This can lead to the theft of call records, unauthorized international calling (toll fraud), and complete system takeover, potentially allowing attackers to use the server as a foothold into the rest of the corporate network.
Technical details
A critical vulnerability exists in the commercial 'endpoint' module of FreePBX versions 15, 16, and 17. The flaw stems from a failure to sufficiently sanitize user-supplied input, which allows an unauthenticated attacker to bypass authentication mechanisms. By chaining this bypass with subsequent SQL injection and command execution steps, an attacker can achieve arbitrary database manipulation and remote code execution (RCE) with potential root privileges. The vulnerability has been observed being exploited in the wild to install persistent backdoors (e.g., .clean.sh) and conduct unauthorized calling activities. Patches are available in endpoint module versions 15.0.66, 16.0.89, and 17.0.3.
Affected products
- Sangoma FreePBX endpoint module < 15.0.66, < 16.0.89, < 17.0.3
Timeline
- 2025-08-21: exploited: Earliest observed exploitation in the wild reported by vendor.
- 2025-08-26: other: Edge fix released for testing.
- 2025-08-28: patched: Stable security updates released for all supported versions.
- 2025-08-28: advisory: GitHub Security Advisory GHSA-m42g-xg4c-5f3h published.
- 2025-08-29: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog.