CVE-2025-59056 - CVE House

Back to Database

Status published Medium CVE-2025-59056

FreePBX vulnerable to unauthenticated Denial of Service

6.6 CVSS

Vulnerability Description

FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59056

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreePBX

View All →

Authenticated SQL Injection in FreePBX tts (Text To Speech) module

Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation

FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API

FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

Affected Vendor

FreePBX

View all reports →

Affected Software

framework

Vulnerable Versions:

< 15.0.38, >= 16.0.0, < 16.0.41, >= 17.0.0, < 17.0.21

Timeline

Official Publish: September 15th, 2025

Last Modified: February 13th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation