CVE-2025-57819
Published: 28 August 2025
Summary
CVE-2025-57819 is a critical-severity SQL Injection (CWE-89) vulnerability in Sangoma Freepbx. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely patching of affected FreePBX versions 15.0.66, 16.0.89, and 17.0.3 to fix the sanitization and authentication bypass flaws.
Addresses insufficient sanitization of user-supplied data by validating and sanitizing inputs to prevent SQL injection leading to database manipulation.
Enforces approved authorizations to block unauthenticated access to the FreePBX Administrator interface, countering the authentication bypass.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated access via SQL injection enables arbitrary DB manipulation and RCE (T1190), demonstrated by deploying web shells (T1505.003), adding cron jobs (T1053.003), and creating local accounts (T1136.001).
NVD Description
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has…
more
been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
Deeper analysisAI
CVE-2025-57819 is a critical vulnerability in FreePBX, an open-source web-based graphical user interface for managing PBX systems. It affects FreePBX 15, 16, and 17 endpoints due to insufficiently sanitized user-supplied data, enabling unauthenticated access to the FreePBX Administrator interface. This flaw allows arbitrary database manipulation and remote code execution, as classified under CWE-89 (SQL Injection) and CWE-288 (Authentication Bypass). The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
Unauthenticated attackers with network access can exploit this vulnerability without requiring privileges, user interaction, or special conditions. Exploitation grants high-impact access to manipulate the database arbitrarily and execute remote code on the affected endpoint, potentially leading to full system compromise, data exfiltration, or further lateral movement within the network.
The vulnerability has been addressed in patched endpoint versions 15.0.66, 16.0.89, and 17.0.3. FreePBX community advisories urge immediate lockdown of administrator access, with detailed guidance available via their forum announcement. Additional resources include GitHub security advisories from FreePBX and WatchTowr Labs, which provide technical details and proof-of-concept information.
This CVE appears in CISA's Known Exploited Vulnerabilities Catalog, signaling real-world exploitation activity. Security practitioners should prioritize patching and network segmentation for FreePBX deployments.
Details
- CWE(s)
- KEV Date Added
- 29 August 2025