erroneo.us
Search all guides⌘K

Security Digest · Aug 26, 2025 · Vulnerability · Other

FreePBX CVE-2025-57819: Mass-Exploited Pre-Auth SQLi to RCE

Pre-auth SQL injection in the FreePBX endpoint module, mass-exploited from Aug 2025. Fixed in 15.0.66, 16.0.89, 17.0.3. Lock down the admin panel and hunt.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Check exposure

Patched since August 2025, but Shadowserver counted at least 386 compromised PBXs within about a week; confirm the endpoint module is fixed, keep the admin panel off the internet, and hunt on any system that was exposed in late August 2025.

Who must act: Operators of FreePBX 15, 16 or 17 with the commercial endpoint module whose Administrator Control Panel was reachable from the internet or other untrusted networks, above all between August 21 and August 28, 2025.

Who can relax: Systems without the endpoint module, and patched systems whose admin panel only trusted networks can reach and that show none of the indicators below.

Affected
FreePBX 15 endpoint module before 15.0.66
FreePBX 16 endpoint module before 16.0.89
FreePBX 17 endpoint module before 17.0.3
End-of-life FreePBX versions: untested, may be affected
Fixed in
endpoint 15.0.66, 16.0.89 and 17.0.3 (Aug 28, 2025)
On FreePBX 17, also filestore 17.0.3 or later for CVE-2025-64328
CVSS
10.0 (v4.0, CNA)
EPSS
95.0% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check the endpoint module version with fwconsole ma list.
  2. Update all modules with fwconsole ma upgradeall, then fwconsole reload.
  3. Restrict the Administrator Control Panel to trusted addresses with the FreePBX Firewall module or an upstream firewall.
  4. If the panel was exposed in late August 2025, run the checks below; if any hit, rebuild from a backup taken before August 21, 2025 or from scratch.
  5. Change every admin password and remove admin users you do not recognize.

How to check if you are affected or compromised

  • Check whether /etc/freepbx.conf is missing or recently modified, and whether /var/www/html/.clean.sh exists.
  • Search Apache access logs for POST requests to modular.php.
  • Search Asterisk logs and CDRs for calls to extension 9998 you did not configure.
  • Look for unknown users in the ampusers table and unexpected commands in the cron_jobs table of the asterisk database.

What happened#

On August 26, 2025, Sangoma's FreePBX security team posted a community advisory titled "Please Lock Down Your Administrator Access." Some systems with the Administrator Control Panel exposed to the internet were being compromised, and the team offered an untested "EDGE" fix for the commercial endpoint module. On August 28 it pushed stable fixes and published GHSA-m42g-xg4c-5f3h. The advisory says that "on or before August 21st, 2025" an unauthorized user reached FreePBX 16 and 17 systems with weak IP filtering or ACLs, through a sanitization error in the endpoint module, and could chain it toward root access.

The CVE record calls it an authentication bypass (CWE-288) plus SQL injection (CWE-89) that gives unauthenticated access to FreePBX Administrator, arbitrary database changes and remote code execution. The CNA scores it CVSS 4.0 10.0; NVD gives 9.8.

On September 10, watchTowr Labs explained the chain. A value passed to /admin/ajax.php reaches FreePBX's class autoloader, which loads module PHP files without a login. That exposes the endpoint module's brand parameter to SQL injection. Attackers used it to add a backdoor admin to the ampusers table. watchTowr reached code execution by writing a row into the cron_jobs table. It notes the patch fixes only the SQL injection, while the pre-auth loading behavior remains in core code. CISA added the CVE to the KEV catalog on August 29. That day, Shadowserver counted 6,620 vulnerable instances and at least 386 compromised ones, according to Born's Tech and Windows World.

Who is affected#

FreePBX 15, 16 and 17 with the endpoint module below 15.0.66, 16.0.89 and 17.0.3. The advisory says end-of-life versions are untested but may be affected.

Do you really need to act?#

If your admin panel was reachable from the internet in August 2025, yes: check it. Attackers dropped web shells and a cleanup script, according to The Hacker News, and a later module update does not remove them. Also, this fix is not the last one. On February 3, 2026, CISA added two more FreePBX bugs to KEV: CVE-2025-64328, a post-login command injection in the FreePBX 17 filestore module (see our companion brief), and CVE-2019-19006, an old admin authentication bypass. Keep every module current, not just endpoint.

What to do now#

  1. Check the version: fwconsole ma list | grep -i endpoint.
  2. Update: fwconsole ma upgradeall, then fwconsole reload. On FreePBX 17, confirm filestore is 17.0.3 or later.
  3. Allow the admin panel only from trusted addresses, through the FreePBX Firewall module or a perimeter firewall.
  4. Change all admin passwords and delete unknown admin users.
  5. If you find compromise, rebuild. The forum notes the EDGE fix protects against future attacks but does not clean existing systems.

How to tell if you were hit#

The FreePBX forum lists these checks:

  • ls -l /etc/freepbx.conf /var/www/html/.clean.sh. A missing or freshly modified config, or any .clean.sh, is a red flag.
  • zgrep modular.php /var/log/{httpd,apache2}/*access* for POST requests.
  • grep 9998 /var/log/asterisk/full* for calls to extension 9998.
  • mysql -e "SELECT * FROM ampusers" asterisk for unknown users. Also run mysql -e "SELECT * FROM cron_jobs" asterisk, as watchTowr's checker advises.

Timeline#

  • — Exploitation is under way by this date.
  • — Sangoma posts its community advisory and an EDGE fix. IOCs follow on August 27.
  • — Stable fixes, the GitHub advisory and the CVE are published.
  • — CISA adds the CVE to KEV, with a September 19 deadline.
  • — watchTowr publishes its root-cause analysis.
  • — CISA adds CVE-2025-64328 and CVE-2019-19006 to KEV.

Vulnerability records

  • CVE-2025-57819 · KEV 2025-08-29 · FreePBX is an open-source web-based graphical user interface.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. FreePBX — GHSA-m42g-xg4c-5f3h: Authentication Bypass Leading to SQL Injection and RCE github.com
  2. FreePBX Community — Security Advisory: Please Lock Down Your Administrator Access community.freepbx.org
  3. CVE record — CVE-2025-57819 cve.org
  4. NVD — CVE-2025-57819 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2025-57819 cisa.gov
  6. watchTowr Labs — You Already Have Our Personal Data, Take Our Phone Calls Too (FreePBX CVE-2025-57819) labs.watchtowr.com
  7. watchTowr — Detection artifact generator for CVE-2025-57819 github.com
  8. CVE record — CVE-2025-64328 cve.org
  9. Born's Tech and Windows World — FreePBX CVE-2025-57819: 6,620 unpatched phone systems (Shadowserver data) borncity.com

Coverage and analysis

  1. The Hacker News — FreePBX servers targeted by zero-day flaw, emergency patch now available thehackernews.com