Freepbx Framework vulnerabilities

CVE-2025-66039 [CRITICAL] CWE-287 CVE-2025-66039: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions a FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fi

CVE-2025-55211 [HIGH] CWE-78 CVE-2025-55211: FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, aut FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21.

CVE-2025-59056 [HIGH] CWE-22 CVE-2025-59056: FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious c FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability

CVE-2025-67722 [HIGH] CWE-426 CVE-2025-67722: FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to v FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/