CVE-2025-55210
Sangoma Freepbx 16.0.2 – 16.0.17
Raw vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-55210 is a low-severity Privilege Context Switching Error (CWE-270) vulnerability in Sangoma Freepbx. Its CVSS base score is 2.0 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Access Token Manipulation (T1134); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-55210 is a privilege escalation vulnerability in the FreePBX module api (PBX API), which provides REST and GraphQL API access within FreePBX, an open-source web-based graphical user interface for managing Asterisk. It affects FreePBX versions prior to 17.0.5 and 16.0.17. The flaw, assigned CVSS score 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H) and mapped to CWE-270, stems from insufficient validation in JWT handling, enabling authenticated users to forge tokens signed with the api-oauth.key private key.
An attacker with existing authenticated access to the REST/GraphQL APIs—potentially as a lower-privileged user already connected to the FreePBX instance—can exploit this if they obtain the api-oauth.key (e.g., by accessing the affected instance). They can then generate a custom JWT specifying any desired scopes, such as rest or gql, to gain full access to the APIs and bypass traditional authorization checks. Exploitation requires knowledge of an existing jti (JWT ID) value from the api_access_tokens table in the Asterisk MySQL database, as FreePBX enforces its presence for token validation.
The vulnerability is addressed in FreePBX 17.0.5 and 16.0.17. Patch details are provided in GitHub commits such as bc6f7d72063cffb18babb6559fa351046d7ad19b, c16a3a79b83382fb4884e51174882ed635637002, and d66786634e7e7d3eedcb4d0931b32c415ba6e9ef, along with the security advisory at https://github.com/FreePBX/security-reporting/security/advisories/GHSA-gvgh-p7wj-76cf.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207009
Vulnerability Data
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to 17.0.5 and 16.0.17, FreePBX module api (PBX API) is vulnerable to privilege escalation by authenticated users with REST/GraphQL API access. This vulnerability allows an attacker to…
more
forge a valid JWT with full access to the REST and GraphQL APIs on a FreePBX that they've already connected to, possibly as a lower privileged user. The JWT is signed using the api-oauth.key private key. An attacker can generate their own token if they possess this key (e.g., by accessing an affected instance), and specify any scopes they wish (e.g., rest, gql), bypassing traditional authorization checks. However, FreePBX enforces that the jti (JWT ID) claim must exist in the database (api_access_tokens table in the asterisk MySQL database) in order for the token to be accepted. Therefore, the attacker must know a jti value that already exists on the target instance. This vulnerability is fixed in 17.0.5 and 16.0.17.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
V13.2.2
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces access authorizations according to policy at every request, structurally preventing incorrect privilege elevation or retention across context switches.
AC-6 requires least-privilege assignments and privilege minimization, reducing the opportunity for erroneous privilege state during context transitions.
AC-24 mandates that access-control decisions be made and enforced correctly for each request, directly addressing flawed privilege context switches.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege authorization policies and reviews directly prevents improper privilege changes across contexts.
Integrating secure-development practices catches and eliminates context-switching privilege errors during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Privileged-access-rights control directly addresses improper privilege elevation during context switches.
Access-control policy defines privilege boundaries but does not guarantee correct switching logic.
Managing access rights includes privilege assignment but not runtime context-switch enforcement.
Restricting privileged utilities reduces exposure to context-switch privilege errors.
Secure-SDLC practices can catch privilege-handling defects early but do not guarantee runtime correctness.
Secure-architecture principles encourage least-privilege context separation but leave implementation details open.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-270