CVE-2025-57819 Sangoma FreePBX Authentication Bypass
Unauthenticated attackers can bypass authentication to manipulate the database and execute arbitrary code on FreePBX endpoints.
- Exploited in the wild
- Since 29 Aug 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-57819?
CVE-2025-57819 is a critical authentication bypass vulnerability in Sangoma Freepbx, published on 28 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
Which versions are affected by CVE-2025-57819?
It affects 1 product.
Products include Sangoma Freepbx.
How do I fix CVE-2025-57819?
No fix has been published for CVE-2025-57819 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 19 Sep 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-57819 being exploited?
Yes. Attackers have exploited CVE-2025-57819 in the wild since at least 29 Aug 2025.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 26 proofs of concept on GitHub.
Other vulnerabilities in Sangoma Freepbx
- CVE-2019-19006 Sangoma FreePBX Improper Authentication
- CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
- CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
- CVE-2026-46376 FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface
- CVE-2025-66039 FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
Sources
Also known as GHSA-m42g-xg4c-5f3h.