CVE-2025-57819: critical vulnerability in FreePBX endpoint
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
FreePBX versions 15, 16, and 17 contain a flaw that allows attackers to bypass login requirements and gain unauthorized administrator access without credentials, which can then be exploited to manipulate the database or execute arbitrary code on the server.
An authentication bypass vulnerability in FreePBX 15–17 enables unauthenticated attackers to access the Administrator interface through insufficiently sanitized user input. This leads to chained SQL injection (CWE-89) and remote code execution capabilities, affecting core system integrity without requiring prior credentials or user interaction.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.