FreePBX 17.0.2 - Remote Code Execution (RCE)
Affects Sangoma FreePBXSource Exploit-DB RSS Feed
Exploited in the wild · KEV due 19 Sep 2025 · public exploit available (Metasploit, Exploit-DB) · 95% EPSS : apply the vendor's fix or mitigations to Sangoma FreePBX now.
Data as of 10/25/2026, 04:40:10 UTC
- Exploitation
Actively exploited – in CISA KEV since 08/29/2025
- KEV deadline
- 09/19/2025 US federal agencies must patch by this date; a sensible deadline for everyone else.
- EPSS
- 95.0% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Public exploits
- 1 Metasploit module, 1 Exploit-DB entry, a Nuclei detection templatePublic attack or detection tooling exists; see Public exploits below.
What to do
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploits and detection
Metasploit modules
Nuclei detection templates
Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.
Description
FreePBX version 17.0.2 is affected by a remote code execution (RCE) vulnerability. This flaw allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects Linux systems running Debian or Ubuntu with Asterisk. No specific affected sub-versions or patch information is provided.
Impact
Successful exploitation of this vulnerability could allow an attacker to gain remote control over the affected FreePBX system, potentially leading to full system compromise. This could impact the confidentiality, integrity, and availability of the telephony infrastructure relying on FreePBX 17.0.2.
Mitigation
Restrict network access to FreePBX management interfaces and monitor for suspicious activity related to remote code execution attempts.
Weaknesses
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #2OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
- CWE-288Authentication Bypass Using an Alternate Path or Channel (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Indicators of compromise
Exploit source code
# Exploit Title: FreePBX 17.0.2 - Remote Code Execution
# Date: 2026-08-12
# Exploit Author: K3ysTr0K3R (Jared Brits)
# Vendor Homepage: https://www.freepbx.org/
# Software Link: https://github.com/FreePBX/freepbx
# Version: FreePBX 15.x < 15.0.66, 16.x < 16.0.89, 17.x < 17.0.3
# Tested on: Linux (Debian/Ubuntu) with Asterisk
# CVE: CVE-2025-57819
# CWE: CWE-89 (SQL Injection), CWE-288 (Authentication Bypass)
# CVSS: 9.8 (Critical) / CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
# Tags: FreePBX, …