Improper authentication in Sangoma Freepbx
CVSS score
9.8
EPSS probability
%3.3
Risk score
0.3
Published
10 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
This repository documents three security vulnerabilities discovered in FreePBX (CVE-2025-66039, CVE-2025-61678, CVE-2025-61675), including analysis, impact, and proof-of-concept details for security research and awareness purposes.
This vulnerability allows both authenticated and unauthenticated remote attackers to execute remote code on vulnerable FreePBX instances. These issues have been fixed in FreePBX versions 16.0.42, 16.0.92, 17.0.6, and 17.0.22. It's important to note that this authentication bypass vulnerability is not present in the default FreePBX configuration.
Similar Vulnerabilities
SQL injection in Sangoma Freepbx
Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
SQL injection in Sangoma Freepbx
Out-of-bounds write in Sangoma Asterisk
Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files
Improper access control in Sangoma Freepbx
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-66039"