FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE (CVE-2025-57819)

What is affected, what to do

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

The vulnerability is being actively exploited; treat it as a priority. Update FreePBX Endpoint to version 15.0.66, FreePBX Endpoint to version 16.0.89, FreePBX Endpoint to version 17.0.3. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• FreePBX Endpoint lt *..15.0.66
• FreePBX Endpoint lt *..16.0.89
• FreePBX Endpoint lt *..17.0.3

Fixed in

• FreePBX Endpoint 15.0.66
• FreePBX Endpoint 16.0.89
• FreePBX Endpoint 17.0.3

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Find exposure and lock down the admin GUI now: Inventory every FreePBX instance (versions 15, 16, 17) and block internet access to the Administrator Control Panel (/admin/, TCP 80/443) immediately. Use the FreePBX Firewall module (admin access from "Trusted" zones only) or an upstream firewall. Leave SIP/RTP for call handling untouched.
   • Patch: Upgrade the endpoint module to 15.0.66 (FreePBX 15), 16.0.89 (FreePBX 16) or 17.0.3 (FreePBX 17). Check the installed version with fwconsole ma list | grep -i endpoint, upgrade with fwconsole ma upgrade endpoint, then run fwconsole reload. If you don't use the commercial endpoint module, uninstall it entirely.
   • Hunt for compromise before you close the ticket: Patching does not remove backdoors that are already in place. Check:
     • asterisk.ampusers for unknown admin accounts.
     • The cron_jobs table and the asterisk user's crontab for foreign entries.
     • /var/www/html/ for unknown PHP or shell files (e.g. .clean.sh).
     • /etc/freepbx.conf for deletion or tampering.
   • If you find indicators: Isolate the host and capture forensic artefacts (DB dump, webroot, /var/log/). Rebuild from a known-clean backup rather than attempting in-place cleanup. Patch the rebuilt system and re-expose the GUI only in restricted form.
   • Rotate credentials: Rotate all GUI admin passwords, the MySQL/MariaDB user (AMPDBPASS), SIP trunk and provider credentials, and extension secrets. Stolen SIP credentials are a direct route to toll fraud.
   • Contain financial impact: Ask your SIP provider to enable spend caps and block premium-rate and international destinations while the investigation runs.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Put the PBX in a dedicated voice VLAN or DMZ. Expose the admin GUI only to a management network or via VPN/jump host. Restrict PBX egress to SIP providers, Sangoma update servers and NTP; this kills reverse shells and second-stage downloads.
   • WAF/reverse proxy: Drop requests to /admin/ajax.php that target the endpoint module (module= parameter) and carry SQL metacharacters (', --, UNION, SLEEP(, INSERT INTO). As a general rule, reject unauthenticated requests to /admin/ajax.php and /admin/config.php that arrive without a valid session cookie.
   • IPS: Enable Suricata/Snort SQLi signatures for FreePBX endpoints and pull vendor rule updates that reference CVE-2025-57819. As a stopgap, use an http.uri content match on ajax.php combined with a pcre for SQLi patterns.
   • Host hardening: Apply file integrity monitoring (AIDE, auditd watches) to /var/www/html/. Reduce web-server write permissions to the bare minimum. Mount /tmp and /var/tmp with noexec.
   • IAM/least privilege: Keep the number of GUI admins minimal and enforce MFA or a VPN/SSO gate in front of the GUI. Bind the database to localhost only (bind-address=127.0.0.1).
3. 03

   Runbook step 3

   Detection rules

   • Web access logs (Apache /var/log/httpd/ or /var/log/apache2/): Look for requests to /admin/ajax.php with module= plus brand=/template=/model= carrying SQL metacharacters, coming from external IPs with no preceding login. Also flag POSTs to modular.php or to unknown PHP files in the webroot. SPL: index=web uri_path="/admin/ajax.php" (uri_query="*%27*" OR uri_query="*UNION*" OR uri_query="*SLEEP*") | stats count by src_ip
   • Database artefacts: Diff SELECT username FROM asterisk.ampusers; against a baseline on a schedule and alert on new accounts. New or modified cron_jobs rows containing shell commands (curl, wget, base64, bash -c) are a high-confidence compromise indicator.
   • auditd/EDR process ancestry: Alert on httpd/php-fpm → sh/bash → curl/wget/base64/nc, and on crond running scripts from the webroot. Sigma shape: ParentImage|endswith: ['/httpd','/php-fpm'] AND Image|endswith: ['/bash','/sh','/curl','/wget'].
   • Asterisk CDR/full log (/var/log/asterisk/full): Watch for:
     • Calls to unknown or test extensions (e.g. 9998).
     • Sudden international or premium-rate calls.
     • New extensions or trunks created without a change ticket.
   • Network telemetry (Zeek/Suricata): Flag outbound HTTP(S) or raw TCP from the PBX to destinations outside the egress allowlist, and DNS lookups for newly registered domains.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

Source: pwn.watch, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), CSA/SingCERT, cvelistv5

Vendors and products

• FreePBX Endpoint
• Sangoma Sangoma FreePBX

Weakness classes (CWE)

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  Base

  The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

  Entry at MITRE CWE-89

• CWE-288Authentication Bypass Using an Alternate Path or Channel

  Base

  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

  Entry at MITRE CWE-288

References & sources

• github.comFreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5…x_refsource_CONFIRM, pwn-watch
• community.freepbx.orgt/security-advisory-please-lock-down-your-administrator-access/…x_refsource_MISC
• github.comwatchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819Exploit
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819government-resource
• pwn.watchpwn.watch: Sangoma FreePBX: FreePBX Authentication Bypass Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2025-57819pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 17.06.2026NVD analysis modifiedNVD

One NVD translation into another language is hidden.