CVE-2025-57819
Sangoma FreePBX Authentication Bypass Vulnerability
Description
CVE-2025-57819 is a critical SQL injection and authentication bypass vulnerability in Sangoma FreePBX, the widely used open-source web-based GUI for managing Asterisk-based PBX systems. Insufficiently sanitized user input allows unauthenticated attackers to gain access to the FreePBX Administrator interface, perform arbitrary database manipulation, and achieve remote code execution. With a CVSS v3.1 base score of 9.8, CVE-2025-57819 represents the most dangerous class of web application vulnerability: unauthenticated remote code execution. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 19, 2025, and its EPSS score of 67.43% at the 98th percentile indicates near-certain exploitation activity, making immediate patching essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sangoma | freepbx | >= 15.0, < 15.0.66; >= 16.0, < 16.0.89; >= 17.0, < 17.0.3 |
References
- https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203(Issue Tracking, Vendor Advisory)
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h(Mitigation, Vendor Advisory)
- https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819(US Government Resource)
Weakness Type
CWE-89: SQL Injection
CVE-2025-57819 involves CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL injection. In FreePBX, certain endpoints incorporate user-supplied data into SQL queries without proper parameterization, allowing attackers to inject malicious SQL code that manipulates the underlying database, extracts credentials, and modifies application state.
Learn more: CWE-89 — SQL Injection
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVE-2025-57819 is also classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The SQL injection vulnerability enables an unauthenticated attacker to bypass the FreePBX authentication mechanism entirely, gaining direct access to the Administrator interface without valid credentials.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
Impact Analysis
CVE-2025-57819 represents a maximum-severity vulnerability with catastrophic impact across all dimensions. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and needs no user interaction (UI:N). Confidentiality (High): An attacker can extract the entire FreePBX database, which contains call records, voicemail data, user credentials, SIP trunk configurations with authentication details, and potentially recordings of phone conversations. Integrity (High): Through database manipulation, the attacker can modify call routing rules, create unauthorized extensions, alter SIP trunk configurations, and inject malicious dialplan logic that could redirect calls or enable eavesdropping. Availability (High): The attacker can disrupt the entire phone system by corrupting the database, modifying critical configurations, or leveraging the remote code execution capability to shut down services. For organizations relying on FreePBX for business communications, this vulnerability threatens complete loss of phone service and exposure of all voice communications data.
Exploit Maturity
CVE-2025-57819 demonstrates extremely high exploit maturity. Public exploit code is available via watchTowr Labs on GitHub, which provides a detailed proof-of-concept for exploiting the SQL injection and authentication bypass chain. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 19, 2025. The EPSS score of 67.43% at the 98th percentile places it in the top 2% of all vulnerabilities by exploitation probability, indicating widespread and active exploitation campaigns. The combination of publicly available exploit code, no authentication requirement, and the ability to achieve remote code execution makes CVE-2025-57819 one of the most actively targeted vulnerabilities in telecommunications infrastructure. Organizations running unpatched FreePBX instances exposed to the internet should assume compromise and initiate incident response procedures.
Remediation
-
Patch immediately. Upgrade FreePBX endpoints to version 15.0.66, 16.0.89, or 17.0.3 depending on your installed major version. The Sangoma advisory at GHSA-m42g-xg4c-5f3h provides specific upgrade instructions.
-
Restrict network access to the FreePBX web interface. The administrator interface should never be directly exposed to the internet. Implement firewall rules to restrict access to the web management interface to trusted IP addresses or VPN connections only. The FreePBX community advisory emphasizes locking down administrator access.
-
Conduct a forensic investigation. If the FreePBX instance was internet-accessible while running a vulnerable version, assume it may have been compromised. Examine database contents for unauthorized modifications, check for new administrator accounts, review SIP trunk configurations for unauthorized changes, and inspect the system for backdoors or malicious code.
-
Rotate all credentials. After patching, change all FreePBX administrator passwords, SIP trunk authentication credentials, and any other secrets stored in the FreePBX database. If the FreePBX server shares credentials with other systems, rotate those credentials as well.
-
Implement defense-in-depth measures. Deploy a web application firewall (WAF) in front of the FreePBX interface. Enable logging and monitoring for SQL injection patterns and unauthorized access attempts. Set up alerts for administrative actions and configuration changes.
Technical Details
CVE-2025-57819 is a combined SQL injection and authentication bypass vulnerability in FreePBX versions 15, 16, and 17. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the worst-case exploitability profile: network-accessible, low complexity, no authentication, no user interaction, with maximum impact. The vulnerability chain begins with CWE-89 (SQL Injection): certain FreePBX endpoints fail to properly parameterize user input before incorporating it into SQL queries, allowing attackers to inject arbitrary SQL statements. This SQL injection capability is then leveraged to achieve CWE-288 (Authentication Bypass): by manipulating the database through injected SQL commands, the attacker can either extract existing administrator credentials or directly modify session and authentication data to gain unauthenticated access to the FreePBX Administrator interface. Once authenticated as an administrator, the attacker can leverage built-in FreePBX functionality to upload and execute arbitrary code on the underlying server, completing the remote code execution chain. The scope is unchanged (S:U), but the complete compromise of the FreePBX server effectively grants control over the entire telecommunications infrastructure it manages.
Frequently Asked Questions
Is CVE-2025-57819 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2025-57819 in the Known Exploited Vulnerabilities catalog. Public exploit code from watchTowr Labs is available on GitHub. The EPSS score of 67.43% at the 98th percentile indicates near-certain exploitation activity.
What products are affected by CVE-2025-57819?
FreePBX versions 15 (before 15.0.66), 16 (before 16.0.89), and 17 (before 17.0.3) are vulnerable. This affects the endpoint components of the FreePBX web GUI that manage the Asterisk PBX system.
How do I fix CVE-2025-57819?
Update FreePBX endpoints to version 15.0.66, 16.0.89, or 17.0.3 depending on your major version. Immediately restrict internet access to the web management interface. Rotate all credentials stored in the FreePBX database after patching.
How severe is CVE-2025-57819?
CVE-2025-57819 has a CVSS v3.1 base score of 9.8 (Critical severity), the highest practical score for a scope-unchanged vulnerability. It requires no authentication, enables remote code execution, and has public exploit code available, making it one of the most dangerous vulnerabilities in telecommunications infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.