Back to Database
Status published
Critical
CVE-2025-57819
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
Vulnerability Description
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-57819
Credits & Attribution
No credits recorded in the NVD database.
References
More from FreePBX
View All →CVE-2025-67736
Authenticated SQL Injection in FreePBX tts (Text To Speech) module
High
8.6
CVE-2025-67722
Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation
Medium
5.7
CVE-2025-67513
FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API
Medium
6.9
CVE-2025-66039
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
Critical
9.3
CVE-2025-64328
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
High
8.6
Affected Vendor
FreePBX
View all reports →Affected Software
endpoint
Vulnerable Versions:
< 15.0.66, < 16.0.89, < 17.0.3
Timeline
Official Publish:
August 28th, 2025
Last Modified:
February 26th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1059
Command and Scripting Interpreter
Execution
T1213.006
Databases
Collection
T1485
Data Destruction
Impact
T1078
Valid Accounts
Persistence
T1550
Use Alternate Authentication Material
Defense Evasion
T1021
Remote Services
Lateral Movement
T1098
Account Manipulation
Privilege Escalation