Veille CVE
CVE-2025-57819
9.8 Critique Exploitée activementCatalogue CISA KEV — Sangoma FreePBX Authentication Bypass Vulnerability
Ajoutée le 29/08/2025 · Échéance de correction (agences US) : 19/09/2025
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 4.0 | 10.0 Critique | security-advisories@github.com | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203 Issue TrackingVendor Advisory
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h MitigationVendor Advisory
- https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819 ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819 US Government Resource