FreePBX Servers Hit by 0-Day Exploit, Disable Internet Access Advised

FreePBX administrators worldwide have been urged to immediately disable public internet access to their systems after a critical 0-day vulnerability was discovered in the commercial Endpoint Manager module. The Sangoma FreePBX Security Team confirmed that attacker‑controlled exploit code can gain unauthenticated remote code execution on systems with the Administrator Control Panel exposed to hostile networks, prompting an urgent advisory on 26 August and a follow‑up update urging continued lockdown measures.

According to Sangoma, the vulnerability affects FreePBX versions 16 and 17 when the Endpoint module is installed and accessible via ports 80 or 443, with exploitation leading to privilege escalation and remote command execution under the web server user, allowing threat actors to deploy cleanup scripts, install persistent backdoors and exfiltrate call detail records.

Initial compromises are indicated to have begun on 21 August, with web interface failures and anomalous Apache POST requests targeting modular.php; insiders say a stable fix was expected within 36 hours and an EDGE‑channel update was issued for immediate testing.

FreePBX users on v16 can run “fwconsole ma downloadinstall endpoint –tag 16.0.88[.]19,” while v17 administrators should use “fwconsole ma downloadinstall endpoint –tag 17.0.2[.]31,” and EDGE users are advised to verify module versions via Admin → Module Admin.

Operators are told to look for indicators such as a malicious “.clean[.]sh” file in /var/www/html, check /etc/freepbx.conf integrity, and review web server logs for POST requests to modular.php dating back to 21 August, with Asterisk logs showing calls to extension 9998 and MariaDB logs for unexpected ampuser entries; if detected, perform a full forensic snapshot or reinstall from a clean backup.

Containment steps include restricting the Administrator Control Panel to trusted IPs via the FreePBX Firewall module, or ideally placing the PBX behind a VPN or isolated management VLAN, and, for those without the Endpoint Manager, auditing exposure and confirming no unauthorized modules are active.