CVE-2019-19006criticalunder attackCWE-287

CVE-2019-19006

Published · Updated

Follow this CVE+ Monitor FreePBX

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 56%
from disclosure to weapon
Published on NVDNov 21
CISA KEV+2266d
Action required by CISAfederal deadline: 2026-02-24

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

FreePBX versions 15.0.16.26 and earlier, 14.0.13.11 and earlier, and 13.0.197.13 and earlier have a flaw that allows attackers to bypass access controls and gain unauthorized access to the system. This means someone could perform actions they shouldn't be allowed to do without proper authentication or permission.

Technical detail

This vulnerability is an authentication bypass or improper access control flaw (CWE-287) affecting multiple FreePBX versions. An attacker can circumvent authorization checks to access restricted functionality or administrative features, potentially without valid credentials or privilege escalation, leading to complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a