Actively Exploited FreePBX Flaw Enables Unauthorized Access and Code Execution

FreePBX remediated CVE-2025-57819, an insufficient input-validation vulnerability affecting FreePBX versions 15, 16, and 17. The flaw can let an attacker gain unauthorized access and potentially execute arbitrary code on affected PBX systems.

FreePBX reported active exploitation against multiple version 16 and 17 deployments with internet-exposed management interfaces, particularly where IP filtering and access-control lists (ACLs) were inadequate. Organizations should apply the vendor security updates, confirm the Endpoint module is at the required patched version, restrict administrator interfaces to trusted networks, and investigate exposed systems using FreePBX-provided indicators of compromise.