CVE-2025-59051highCWE-78

CVE-2025-59051: falha de alta gravidade em FreePBX endpoint

FreePBX Endpoint Manager command injection via Network Scanning feature

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar endpoint

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.5%
The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. Updating to Endpoint Manager 16.0.92 or 17.0.6 addresses the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
FreePBX · endpoint
CVEs relacionadas — FreePBX endpoint

No mesmo produto, das mais perigosas para as menos.

CVE-2025-57819CRITICALFreePBX Affected by Authentication Bypass Leading to SQL Injection and RCEEPSS 95.2%KEVCVE-2025-61675HIGHFreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parametersEPSS 40.3%CVE-2025-67513MEDIUMFreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST APIEPSS 0.3%