CVE-2025-57819
Sangoma FreePBX: Authentication Bypass
As of , CVE-2025-57819 in Sangoma FreePBX is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 29 August 2025
- US federal deadline
- 19 September 202521 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.85Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- 1 Metasploit module and 1 Exploit-DB entry
- Fix
- Vendor advice: github.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
CISA's description
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
The CVE record's description, from GitHub_M
- CVE published
- 28 August 2025
- Assigned by
- GitHub_M
- CVSS
- 10.0 Critical (CVSS 4.0, from the CNA)
- CWE-89
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-288
- Authentication Bypass Using an Alternate Path or Channel
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
- Exploit-DB published an exploit (EDB-ID 52681).
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: FreePBX ajax.php unauthenticated SQLi to RCEexploit module, rank excellent
- Exploit-DB: FreePBX 17.0.2 - Remote Code Execution (RCE)EDB-ID 52681, 3 September 2026
FreePBX: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2025-64328OS Command Injection | Sangoma FreePBX | Patch this weekMetasploit module; EPSS 0.85 | 0.85 | ||
| CVE-2019-19006Improper Authentication | Sangoma FreePBX | Patch this weekEPSS 0.56 | 0.56 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org