CVE-2025-59051 FreePBX Endpoint Manager command injection via Network Scanning feature
Authenticated attackers can execute arbitrary OS commands via the Network Scanning feature in FreePBX Endpoint Manager.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59051?
CVE-2025-59051 is a high-severity command injection vulnerability in FreePBX endpoint, published on 14 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. Updating to Endpoint Manager 16.0.92 or 17.0.6 addresses the issue.
Weakness: CWE-78
Which versions are affected by CVE-2025-59051?
How do I fix CVE-2025-59051?
No fix has been published for CVE-2025-59051 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-59051 being exploited?
There is no known exploitation of CVE-2025-59051 in the wild and no public exploit code.