CyberSec.Space Logo
返回 CVE 瀏覽器

CVE-2025-57819

🔥 Known Exploited (CISA KEV)CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-08-28
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

Affected Platforms (CPE)

📦
Sangoma

Freepbx

>= 15.0 and < 15.0.66>= 16.0 and < 16.0.89>= 17.0 and < 17.0.3

References & Advisories

🔗 https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
🔗 https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
🔗 https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819

相關漏洞威脅

CVE-2026-465164.8

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'...

CVE-2026-26978

FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during r...

CVE-2026-405207.2

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function wher...

CVE-2025-677368.6

The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk...