CVE-2025-57819: Sangoma FreePBX Authentication Bypass Vulnerability
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
Other sources
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sangoma FreePBXto a version that resolves this vulnerability.Fixed in 15.0.66 - Upgrade
Upgrade
Sangoma FreePBXto a version that resolves this vulnerability.Fixed in 16.0.89 - Upgrade
Upgrade
Sangoma FreePBXto a version that resolves this vulnerability.Fixed in 17.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57819?
CVE-2025-57819 is considered a critical vulnerability due to the potential for unauthenticated access to FreePBX Administrator and arbitrary database manipulation.
How do I fix CVE-2025-57819?
To fix CVE-2025-57819, update your FreePBX installation to the latest version as specified in the security advisories.
Which versions of FreePBX are affected by CVE-2025-57819?
FreePBX versions 15.0.66 and below, 16.0.89 and below, and 17.0.3 and below are affected by CVE-2025-57819.
What kind of access does CVE-2025-57819 allow an attacker?
CVE-2025-57819 allows an attacker to gain unauthenticated access to FreePBX Administrator, potentially leading to arbitrary code execution.
How can I mitigate risks associated with CVE-2025-57819?
To mitigate risks from CVE-2025-57819, ensure that administrator access is locked down and limit network exposure while upgrading to a patched version of FreePBX.