CVE-2024-58294 - CVE House

Back to Database

Status published High CVE-2024-58294

FreePBX 16 Authenticated Remote Code Execution via API Module

8.7 CVSS

Vulnerability Description

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-58294

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Cold z3ro

References

More from FreePBX

View All →

Authenticated SQL Injection in FreePBX tts (Text To Speech) module

Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation

FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API

FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

Affected Vendor

FreePBX

View all reports →

Affected Software

FreePBX

Vulnerable Versions:

16

Timeline

Official Publish: December 11th, 2025

Last Modified: July 14th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel