CVE-2019-19006
Sangoma FreePBX Improper Authentication Vulnerability
Description
CVE-2019-19006 is a critical improper authentication vulnerability in Sangoma FreePBX that allows remote unauthenticated attackers to bypass administrative authentication and gain full control of the PBX system. With a CVSS v3.1 base score of 9.8, the flaw enables an attacker to access the FreePBX administrative interface without valid credentials. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 24, 2026, and the ransomware association is currently classified as unknown. The EPSS score of 26.86% at the 96.3rd percentile places this among the most aggressively exploited vulnerabilities currently tracked, reflecting sustained and widespread exploitation against internet-exposed FreePBX installations. Affected versions include FreePBX 13.0.197.13 and below, 14.0.13.11 and below, and 15.0.16.26 and below.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sangoma | freepbx | >= 13.0.0.0, <= 13.0.197.13; >= 14.0.0.0, <= 14.0.13.11; >= 15.0.0.0, <= 15.0.16.26 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772(Vendor Advisory)
- https://pastebin.com/2CdsQMKW(Broken Link)
- https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+Bypass(Vendor Advisory)
- https://www.freepbx.org/category/blog/(Product)
- https://research.checkpoint.com/2020/inj3ctor3-operation-leveraging-asterisk-servers-for-monetization/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19006(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2019-19006 is classified under CWE-287 (Improper Authentication). This weakness occurs when software does not properly verify that an actor claiming a particular identity actually possesses the appropriate credentials. In Sangoma FreePBX, the authentication mechanism contains a flaw that allows an attacker to bypass the login process entirely, gaining administrative access to the PBX management interface without providing valid credentials. Improper authentication vulnerabilities in administrative interfaces represent among the most severe security failures because they eliminate the primary access control boundary that protects system configuration and management functions. When the authentication bypass is combined with FreePBX's powerful administrative capabilities including call routing, extension management, and system configuration, the attacker effectively owns the entire telephony infrastructure. Learn more about CWE-287
Impact Analysis
The impact of CVE-2019-19006 is catastrophic across all dimensions of the CIA triad due to the complete authentication bypass granting administrative access. Confidentiality is fully compromised because administrative access to FreePBX exposes call detail records for all extensions, voicemail recordings, SIP account credentials, trunk authentication details, system configuration including network settings, and any data stored on the server. An attacker with administrative access can also configure call recording on any extension to capture future conversations.
Integrity suffers maximum impact as the attacker can modify all PBX configurations, including dial plans, call routing rules, extension settings, trunk configurations, and system settings. The attacker can redirect calls to external numbers for interception, create unauthorized extensions, modify voicemail greetings for social engineering campaigns, alter caller ID settings to impersonate legitimate users, and reconfigure trunks to enable toll fraud by routing expensive international calls through the system.
Availability faces critical risk because the attacker can disable telephony services, delete configurations, lock out legitimate administrators by changing passwords, or use the system's underlying OS access (often available through FreePBX admin functions) to deploy destructive payloads. The EPSS score of 26.86% at the 96.3rd percentile confirms that this six-year-old vulnerability remains under intense exploitation. Despite being disclosed in 2019, the continued KEV listing and high EPSS score indicate that a significant number of FreePBX installations remain unpatched and exposed, providing an ongoing target-rich environment for attackers. The ransomware association is unknown, but administrative access to the underlying server enables ransomware deployment.
Exploit Maturity
CVE-2019-19006 has exceptionally high exploit maturity reflecting over six years of public knowledge and exploitation. The EPSS score of 26.86% at the 96.3rd percentile means that approximately one in four exposed FreePBX installations faces exploitation attempts, and CISA's recent KEV addition with a remediation deadline of February 24, 2026 confirms that exploitation continues to pose a significant threat to government and critical infrastructure environments. The original vendor advisory is available at the FreePBX Community forum, and detailed technical information is documented in the FreePBX wiki.
The authentication bypass is straightforward to exploit and requires no specialized tools or expertise. The vulnerability has been well-documented since November 2019, and exploit code and techniques have been widely available in the security community for years. Automated scanning tools regularly probe for FreePBX installations and attempt the authentication bypass as part of their standard vulnerability checks. The long exposure window means that any FreePBX instance running affected versions that has been internet-accessible at any point should be considered compromised. The ransomware association is unknown, but the complete administrative access achieved through the bypass provides all the capabilities needed for data exfiltration, lateral movement, and ransomware deployment.
Remediation
-
Upgrade FreePBX immediately to a version that resolves the authentication bypass. For the 13.x branch, upgrade beyond 13.0.197.13. For the 14.x branch, upgrade beyond 14.0.13.11. For the 15.x branch, upgrade beyond 15.0.16.26. Given the six-year age of this vulnerability and the extremely high exploitation rate, organizations should strongly consider upgrading to the latest supported FreePBX release rather than applying minimal patches, as older branches may contain additional unpatched vulnerabilities.
-
Remove FreePBX administrative interfaces from internet exposure immediately as the most critical compensating control. The administrative web interface should never be directly accessible from the internet. Implement firewall rules to restrict access to the administration port to specific trusted IP addresses and require VPN access for remote management. This single control significantly reduces the risk of exploitation.
-
Conduct a thorough forensic investigation of any FreePBX system that was running an affected version while exposed to untrusted networks. Given the EPSS score of 26.86% and six years of public exploit availability, the probability that an exposed system was compromised at some point is extremely high. Check for unauthorized admin accounts, modified configurations, call forwarding rules to external numbers, unauthorized SIP trunks, web shells, and backdoor accounts on the underlying operating system.
-
Reset all credentials associated with the FreePBX system after upgrading, including all administrative passwords, SIP extension passwords, trunk authentication credentials, AMI credentials, and database passwords. Implement strong, unique passwords for all accounts and enable two-factor authentication for administrative access if supported.
-
Audit telephony records for toll fraud by reviewing call detail records for unusual patterns including international calls to premium-rate numbers, calls during non-business hours, calls from extensions that should be inactive, and high-volume outbound calling that could indicate the system was used as a relay. Contact your telephony provider if toll fraud is detected.
Technical Details
CVE-2019-19006 is an improper authentication vulnerability in Sangoma FreePBX, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every component of the vector reflects maximum exploitability: Attack Vector (AV:N) confirms remote network exploitation through the web interface. Attack Complexity (AC:L) means the bypass is trivially reliable. Privileges Required (PR:N) confirms no authentication is needed, which is the core of the vulnerability. User Interaction (UI:N) indicates fully automated exploitation. Scope (S:U) keeps impact within the FreePBX context, but this includes full administrative control over the PBX and often the underlying operating system.
The vulnerability is described as "Incorrect Access Control" in the FreePBX security advisory (SEC-2019-001). The authentication bypass allows an unauthenticated remote attacker to gain administrative access to the FreePBX web interface by exploiting a flaw in the session management or authentication validation logic. The specific technical mechanism involves manipulating authentication requests or session tokens in a way that the application incorrectly validates, granting administrative privileges without proper credential verification. Once authenticated as an administrator, the attacker has full control over the PBX system, including the ability to modify all configurations, access all data, and in many configurations, execute operating system commands through built-in administrative functions.
The affected versions span three major release branches: FreePBX 13.0.0.0 through 13.0.197.13, 14.0.0.0 through 14.0.13.11, and 15.0.0.0 through 15.0.16.26. FreePBX is built on the Asterisk PBX platform and typically runs on Linux systems with the web interface served by Apache. The administrative interface provides extensive control over the telephony system including extension management, trunk configuration, dial plan editing, module management, and system maintenance functions, all of which become attacker-accessible through the authentication bypass.
Frequently Asked Questions
What is CVE-2019-19006?
CVE-2019-19006 is a critical authentication bypass vulnerability in Sangoma FreePBX that allows unauthenticated remote attackers to gain full administrative access to the PBX system. Despite being discovered in 2019, it remains one of the most actively exploited vulnerabilities with an EPSS score of 26.86% and a CVSS score of 9.8.
Why is a vulnerability from 2019 still being actively exploited?
Many FreePBX installations are deployed by small organizations or managed service providers and may not have consistent patch management processes. FreePBX systems are often set up and left running for years without updates, and many remain directly accessible from the internet. Attackers use automated scanning to continuously discover and exploit these unpatched systems.
What can an attacker do after bypassing FreePBX authentication?
With administrative access, the attacker can read all call records, listen to voicemails, modify call routing to intercept conversations, create unauthorized extensions, configure the system for toll fraud, extract SIP credentials, and in many configurations, execute commands on the underlying operating system.
How do I check if my FreePBX system is affected?
Check your FreePBX version in the administrative interface under Admin > Module Admin or by reviewing the system dashboard. If you are running version 13.0.197.13 or below, 14.0.13.11 or below, or 15.0.16.26 or below, your system is vulnerable and must be upgraded immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.