---
title: "FreePBX CVE-2025-57819: Mass-Exploited Pre-Auth SQLi to RCE"
url: https://erroneo.us/security/briefs/freepbx-cve-2025-57819-endpoint-auth-bypass-sqli-rce/
description: "Pre-auth SQL injection in the FreePBX endpoint module, mass-exploited from Aug 2025. Fixed in 15.0.66, 16.0.89, 17.0.3. Lock down the admin panel and hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-08-26
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-57819"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FreePBX CVE-2025-57819: Mass-Exploited Pre-Auth SQLi to RCE

**Verdict: Check exposure.** Patched since August 2025, but Shadowserver counted at least 386 compromised PBXs within about a week; confirm the endpoint module is fixed, keep the admin panel off the internet, and hunt on any system that was exposed in late August 2025.

- **Who must act:** Operators of FreePBX 15, 16 or 17 with the commercial endpoint module whose Administrator Control Panel was reachable from the internet or other untrusted networks, above all between August 21 and August 28, 2025.
- **Who can relax:** Systems without the endpoint module, and patched systems whose admin panel only trusted networks can reach and that show none of the indicators below.
- **Affected:** FreePBX 15 endpoint module before 15.0.66; FreePBX 16 endpoint module before 16.0.89; FreePBX 17 endpoint module before 17.0.3; End-of-life FreePBX versions: untested, may be affected
- **Fixed:** endpoint 15.0.66, 16.0.89 and 17.0.3 (Aug 28, 2025); On FreePBX 17, also filestore 17.0.3 or later for CVE-2025-64328
- **CVEs:** CVE-2025-57819
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the endpoint module version with fwconsole ma list.
2. Update all modules with fwconsole ma upgradeall, then fwconsole reload.
3. Restrict the Administrator Control Panel to trusted addresses with the FreePBX Firewall module or an upstream firewall.
4. If the panel was exposed in late August 2025, run the checks below; if any hit, rebuild from a backup taken before August 21, 2025 or from scratch.
5. Change every admin password and remove admin users you do not recognize.

### How to check if you are affected

- Check whether /etc/freepbx.conf is missing or recently modified, and whether /var/www/html/.clean.sh exists.
- Search Apache access logs for POST requests to modular.php.
- Search Asterisk logs and CDRs for calls to extension 9998 you did not configure.
- Look for unknown users in the ampusers table and unexpected commands in the cron_jobs table of the asterisk database.

## What happened

On August 26, 2025, Sangoma's FreePBX security team posted a [community advisory](https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203) titled "Please Lock Down Your Administrator Access." Some systems with the Administrator Control Panel exposed to the internet were being compromised, and the team offered an untested "EDGE" fix for the commercial endpoint module. On August 28 it pushed stable fixes and published [GHSA-m42g-xg4c-5f3h](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h). The advisory says that "on or before August 21st, 2025" an unauthorized user reached FreePBX 16 and 17 systems with weak IP filtering or ACLs, through a sanitization error in the endpoint module, and could chain it toward root access.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-57819) calls it an authentication bypass (CWE-288) plus SQL injection (CWE-89) that gives unauthenticated access to FreePBX Administrator, arbitrary database changes and remote code execution. The CNA scores it CVSS 4.0 10.0; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-57819) gives 9.8.

On September 10, [watchTowr Labs](https://labs.watchtowr.com/you-already-have-our-personal-data-take-our-phone-calls-too-freepbx-cve-2025-57819/) explained the chain. A value passed to `/admin/ajax.php` reaches FreePBX's class autoloader, which loads module PHP files without a login. That exposes the endpoint module's `brand` parameter to SQL injection. Attackers used it to add a backdoor admin to the `ampusers` table. watchTowr reached code execution by writing a row into the `cron_jobs` table. It notes the patch fixes only the SQL injection, while the pre-auth loading behavior remains in core code. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819) on August 29. That day, Shadowserver counted 6,620 vulnerable instances and at least 386 compromised ones, according to [Born's Tech and Windows World](https://borncity.com/blog/2025/09/01/freepbx-cve-2025-57819-cvss-10-0-6620-ungepatchte-telefonanlagen/).

## Who is affected

FreePBX 15, 16 and 17 with the endpoint module below 15.0.66, 16.0.89 and 17.0.3. The advisory says end-of-life versions are untested but may be affected.

## Do you really need to act?

If your admin panel was reachable from the internet in August 2025, yes: check it. Attackers dropped web shells and a cleanup script, according to [The Hacker News](https://thehackernews.com/2025/08/freepbx-servers-targeted-by-zero-day.html), and a later module update does not remove them. Also, this fix is not the last one. On February 3, 2026, CISA added two more FreePBX bugs to KEV: [CVE-2025-64328](https://www.cve.org/CVERecord?id=CVE-2025-64328), a post-login command injection in the FreePBX 17 filestore module (see our companion brief), and CVE-2019-19006, an old admin authentication bypass. Keep every module current, not just endpoint.

## What to do now

1. Check the version: `fwconsole ma list | grep -i endpoint`.
2. Update: `fwconsole ma upgradeall`, then `fwconsole reload`. On FreePBX 17, confirm filestore is 17.0.3 or later.
3. Allow the admin panel only from trusted addresses, through the FreePBX Firewall module or a perimeter firewall.
4. Change all admin passwords and delete unknown admin users.
5. If you find compromise, rebuild. The forum notes the EDGE fix protects against future attacks but does not clean existing systems.

## How to tell if you were hit

The FreePBX forum lists these checks:

- `ls -l /etc/freepbx.conf /var/www/html/.clean.sh`. A missing or freshly modified config, or any `.clean.sh`, is a red flag.
- `zgrep modular.php /var/log/{httpd,apache2}/*access*` for POST requests.
- `grep 9998 /var/log/asterisk/full*` for calls to extension 9998.
- `mysql -e "SELECT * FROM ampusers" asterisk` for unknown users. Also run `mysql -e "SELECT * FROM cron_jobs" asterisk`, as [watchTowr's checker](https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819) advises.

## Timeline

- Aug 21, 2025 — Exploitation is under way by this date.
- Aug 26, 2025 — Sangoma posts its community advisory and an EDGE fix. IOCs follow on August 27.
- Aug 28, 2025 — Stable fixes, the GitHub advisory and the CVE are published.
- Aug 29, 2025 — CISA adds the CVE to KEV, with a September 19 deadline.
- Sep 10, 2025 — watchTowr publishes its root-cause analysis.
- Feb 3, 2026 — CISA adds CVE-2025-64328 and CVE-2019-19006 to KEV.

## Sources

1. [FreePBX — GHSA-m42g-xg4c-5f3h: Authentication Bypass Leading to SQL Injection and RCE](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h)
2. [FreePBX Community — Security Advisory: Please Lock Down Your Administrator Access](https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203)
3. [CVE record — CVE-2025-57819](https://www.cve.org/CVERecord?id=CVE-2025-57819)
4. [NVD — CVE-2025-57819](https://nvd.nist.gov/vuln/detail/CVE-2025-57819)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-57819](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819)
6. [watchTowr Labs — You Already Have Our Personal Data, Take Our Phone Calls Too (FreePBX CVE-2025-57819)](https://labs.watchtowr.com/you-already-have-our-personal-data-take-our-phone-calls-too-freepbx-cve-2025-57819/)
7. [watchTowr — Detection artifact generator for CVE-2025-57819](https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819)
8. [CVE record — CVE-2025-64328](https://www.cve.org/CVERecord?id=CVE-2025-64328)
9. [Born's Tech and Windows World — FreePBX CVE-2025-57819: 6,620 unpatched phone systems (Shadowserver data)](https://borncity.com/blog/2025/09/01/freepbx-cve-2025-57819-cvss-10-0-6620-ungepatchte-telefonanlagen/)
10. [The Hacker News — FreePBX servers targeted by zero-day flaw, emergency patch now available](https://thehackernews.com/2025/08/freepbx-servers-targeted-by-zero-day.html)

---
Source page: https://erroneo.us/security/briefs/freepbx-cve-2025-57819-endpoint-auth-bypass-sqli-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt