CVE-2025-57819

What it actually does

This is a critical authentication bypass and input-sanitization flaw in FreePBX 15, 16, and 17 endpoint-related web functionality. Unauthenticated, attacker-supplied data can be processed in a way that grants access to FreePBX Administrator functions without valid credentials. Once that administrative boundary is bypassed, an attacker can manipulate the FreePBX database, alter PBX configuration, create or modify administrative state, and chain those changes into remote code execution through FreePBX/Asterisk management functionality. The provided affected package metadata references Debian otrs2, which does not align with the FreePBX description; remediation should therefore prioritize validating actual FreePBX Endpoint module versions 15.0.66, 16.0.89, or 17.0.3 or later, while separately confirming whether the listed distribution package data is a feed-mapping error.

Why it matters to the business

Successful exploitation can give an external attacker control over a phone-system administration interface, which may disrupt calling, reroute calls, expose voicemail or call data, enable toll fraud, and provide a foothold for broader server compromise. The CVSS score is critical, EPSS is very high at 0.88269, exploitation is reported as active in the wild, and the issue is listed in CISA KEV with a remediation due date of 2025-09-19, making unpatched internet-facing systems an urgent operational risk even though ransomware use is not currently indicated.

How an attack unfolds

An attacker first identifies an exposed FreePBX web administration surface, typically by scanning for reachable FreePBX Administrator or related endpoint-module URLs. They then send crafted unauthenticated HTTP requests containing specially formed user-controlled parameters that are not sufficiently sanitized by vulnerable FreePBX endpoint functionality. The flaw allows the attacker to reach administrator-level behavior without logging in. With that access, the attacker can make unauthorized database changes, such as altering configuration, permissions, or module state. From there, the attacker can abuse legitimate administrative capabilities or modified database values to execute commands in the context of the web/PBX service, persist changes, create backdoor access, tamper with call routing, or stage additional tools. Public exploitation has been reported, so organizations should assume exposed vulnerable systems may have been probed or attacked.

How to fix it

Upgrade the vulnerable FreePBX endpoint component immediately. Fixed endpoint versions are 15.0.66 for FreePBX 15, 16.0.89 for FreePBX 16, and 17.0.3 for FreePBX 17. If FreePBX is managed through the module administration interface or fwconsole, update all FreePBX modules and then specifically verify that the endpoint module is at or above the fixed version. Restrict FreePBX Administrator access to trusted management networks or VPNs, block direct internet access to /admin paths, and enforce web access controls at the reverse proxy or firewall. Rotate FreePBX administrator credentials and API secrets after patching if exposure is suspected. Review database-backed administrator accounts, extension settings, trunk settings, outbound routes, custom destinations, cron jobs, and module configuration for unauthorized changes. The input also lists Debian 11 otrs2 fixed in 2.4.10+dfsg1-1, but that package does not match the FreePBX vulnerability description; treat it as a separate package-validation item rather than the primary fix for this issue.

How to confirm the fix worked

Confirm the installed FreePBX major version and endpoint module version from the FreePBX module administration page or with the local FreePBX module tooling, and verify versions are at least 15.0.66, 16.0.89, or 17.0.3 as applicable. Validate that the FreePBX Administrator interface is not reachable from untrusted networks. Attempt only safe, non-exploitative checks: confirm unauthenticated requests to administrator and endpoint-module paths are rejected with login redirects or authorization failures, not administrative responses. Review package and module update logs to ensure the patch was applied successfully and services restarted. If the system was internet-facing before patching, perform compromise assessment rather than relying only on version validation.

Typical attack path

1. Scan the internet or target network for exposed FreePBX Administrator interfaces.
2. Fingerprint FreePBX version and endpoint-module behavior from HTTP responses, static assets, or admin paths.
3. Send crafted unauthenticated requests to vulnerable endpoint-related routes or administrator functionality.
4. Bypass authentication and reach privileged FreePBX Administrator actions.
5. Manipulate FreePBX database-backed configuration or administrative state.
6. Use administrative functionality or altered configuration to achieve command execution on the PBX host.
7. Establish persistence, add or alter users/extensions/routes, collect call or voicemail data, or deploy additional tooling.
8. Cover tracks by deleting web logs, changing timestamps, or reverting some visible configuration changes.

How to detect it

Review HTTP access and error logs from Apache, Nginx, or the embedded web stack for unauthenticated requests to FreePBX Administrator and endpoint-module paths, especially POST requests, unusual query strings, repeated 200 responses where login redirects are expected, requests lacking normal session cookies, or requests from scanning infrastructure. Examine /var/log/asterisk/freepbx.log and /var/log/asterisk/full for unexpected configuration reloads, module actions, administrator activity, fwconsole execution, extension/trunk changes, or call-routing changes that do not correspond to approved maintenance. Check operating-system logs for the web-server or asterisk service account spawning shells, curl, wget, Python, Perl, PHP CLI, nc, or other command-execution utilities. Inspect FreePBX database contents and administrative configuration for new users, changed permissions, altered outbound routes, suspicious custom destinations, unexpected trunks, unauthorized SIP credentials, or modified module settings. Look for newly created or recently modified PHP files under the FreePBX web root and module directories. Correlate suspected exploitation times with call-detail records for toll fraud, voicemail access, call forwarding, and unusual destination patterns. Because active exploitation is reported, exposed vulnerable systems should be assessed as potentially compromised even if only scanning indicators are found.

• /admin/ajax.php
• /admin/config.php
• /admin/index.php
• module=endpoint
• /admin/modules/endpoint
• /var/www/html/admin/modules/endpoint
• /var/www/html/admin
• /var/log/asterisk/freepbx.log
• /var/log/asterisk/full
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/apache2/access.log
• /var/log/apache2/error.log
• fwconsole
• amportal
• httpd.*sh
• httpd.*bash
• httpd.*curl
• httpd.*wget
• httpd.*python
• httpd.*perl
• apache2.*sh
• apache2.*bash
• apache2.*curl
• apache2.*wget
• apache2.*python
• apache2.*perl
• asterisk.*fwconsole
• asterisk.*curl
• asterisk.*wget
• POST /admin/ajax.php
• POST /admin/config.php

What your security team should do

• Treat this as an emergency patch item for any internet-facing FreePBX deployment because it is KEV-listed, actively exploited, critical severity, and has a very high EPSS probability.
• Inventory all FreePBX 15, 16, and 17 systems and verify endpoint module versions are 15.0.66, 16.0.89, or 17.0.3 or later.
• Immediately restrict access to FreePBX Administrator URLs to trusted administrative networks or VPNs while patching is underway.
• Search web logs for unauthenticated requests to FreePBX admin and endpoint-module paths, especially POST requests and requests with unusual parameters or no authenticated session.
• Review FreePBX administrator users, extension configuration, trunks, outbound routes, custom destinations, voicemail settings, and database audit evidence for unauthorized changes.
• Hunt for web-server child processes spawning shells, download tools, scripting interpreters, or fwconsole commands.
• Rotate administrative credentials, SIP trunk credentials, API tokens, and database credentials if compromise cannot be ruled out.
• Monitor telephony billing and call-detail records for toll fraud, unexpected international calling, forwarding, or premium-rate destinations.
• Resolve the product-mapping discrepancy in vulnerability management data where Debian otrs2 is listed against a FreePBX issue to avoid false assurance or missed remediation.