CVE-2025-57819: Sangoma FreePBX auth bypass and RCE in endpoint module

CVE-2025-57819 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-08-28

FreePBX is a popular open-source web interface used to manage business phone systems (VoIP). A critical security flaw allows unauthorized individuals to bypass login screens and gain full administrative control over the phone system. This can lead to the theft of call records, unauthorized international calling (toll fraud), and complete system takeover, potentially allowing attackers to use the server as a foothold into the rest of the corporate network.

Technologies: Sangoma FreePBX. Vendors: Sangoma.

Quick answers

Is CVE-2025-57819 exploited in the wild?
Yes. CVE-2025-57819 is known to be exploited in the wild, first recorded on 29 August 2025. Treat it as urgent.
How severe is CVE-2025-57819?
Critical severity, with a CVSS score of 9.8, published 28 August 2025.
Which products and versions are affected?
Sangoma FreePBX 15.0 before 15.0.66, 16.0 before 16.0.89, 17.0 before 17.0.3; Sangoma FreePBX endpoint module < 15.0.66, < 16.0.89, < 17.0.3.
Is there a fix for CVE-2025-57819?
A patch was published on 2025-08-28: Stable security updates released for all supported versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-57819 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-57819?
Check whether you run Sangoma FreePBX or Sangoma FreePBX endpoint module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A critical vulnerability exists in the commercial 'endpoint' module of FreePBX versions 15, 16, and 17. The flaw stems from a failure to sufficiently sanitize user-supplied input, which allows an unauthenticated attacker to bypass authentication mechanisms. By chaining this bypass with subsequent SQL injection and command execution steps, an attacker can achieve arbitrary database manipulation and remote code execution (RCE) with potential root privileges. The vulnerability has been observed being exploited in the wild to install persistent backdoors (e.g., .clean.sh) and conduct unauthorized calling activities. Patches are available in endpoint module versions 15.0.66, 16.0.89, and 17.0.3.

Affected products

  • Sangoma FreePBX endpoint module < 15.0.66, < 16.0.89, < 17.0.3

Timeline

  • 2025-08-21: exploited: Earliest observed exploitation in the wild reported by vendor.
  • 2025-08-26: other: Edge fix released for testing.
  • 2025-08-28: patched: Stable security updates released for all supported versions.
  • 2025-08-28: advisory: GitHub Security Advisory GHSA-m42g-xg4c-5f3h published.
  • 2025-08-29: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.