FreePBX Servers Targeted by Zero-Day Flaw, Emergency Patch Now Available

The Hacker News reports that a zero-day vulnerability in FreePBX, CVE-2025-57819 with a CVSS of 10.0, is actively exploited and affects systems whose administrator control panel is exposed to the public internet. According to The Hacker News, the issue allows unauthenticated access to the FreePBX Administrator, enabling arbitrary database manipulation and remote code execution. The vulnerability impacts FreePBX versions 15 prior to 15.0.66, 16 prior to 16.0.89, and 17 prior to 17.0.3.

Sangoma said an unauthorised user began accessing several FreePBX version 16 and 17 systems connected to the internet on or before 21 August 2025, targeting those with lax IP filtering or ACLs by exploiting a sanitisation flaw.

The advisory urges users to upgrade to the latest supported FreePBX versions and to restrict public access to the administrator control panel, while also scanning for IoCs such as the modified or missing /etc/freepbx.conf, the presence of /var/www/html/.clean[.]sh, suspicious POST requests to modular.php, and unusual calls to extension 9998.

Found this article interesting? according to The Hacker News, watchTowr’s Benjamin Harris notes active exploitation since August 21 and warns of potential compromises and post‑compromise backdoors.