Critical FreePBX Flaws Let Unauthenticated Attackers Execute Code and Take Over Administrator Accounts

Critical security vulnerabilities in FreePBX have been disclosed, exposing organizations to risks of unauthenticated remote code execution and the takeover of administrator accounts.

These flaws, tracked under GitHub advisories GHSA-37j8-fhxx-9vhp and GHSA-g27h-xf3q-h3rm, affect FreePBX versions 16 and 17, carrying a CVSS v4 base score of 9.3, which highlights their severity.

Security researchers warn that these issues can be exploited remotely without requiring authentication or user interaction, making internet-facing PBX deployments particularly vulnerable to compromise.

Critical FreePBX Flaws

• Unauthenticated remote code execution in FreePBX UCP via socket.io namespace authentication bypass and Asterisk Manager Interface (AMI) action injection
• Unauthenticated SQL injection in FreePBX missedcall module via crafted Caller ID name leading to administrator account takeover

The first vulnerability impacts the User Control Panel (UCP) module in FreePBX 17 versions prior to 17.0.9. The issue stems from changes in the socket.io v4 library, which weakened authentication controls by bypassing the intended io.use(checkAuth) mechanism.

As a result, unauthenticated attackers can establish connections to the UCP Node server, typically exposed on ports 8001 (HTTP) and 8003 (HTTPS), and send malicious events that trigger arbitrary command execution through the Asterisk Manager Interface.

This effectively grants attackers the ability to execute code as the asterisk user, enabling full system compromise in improperly secured deployments. The vulnerability is categorized under CWE-862 (Missing Authorization), highlighting the absence of proper access control enforcement.

The second flaw affects the missedcall module in FreePBX 16 and 17. It arises from improper sanitization of Caller ID name input when logging missed calls into the database.

Specifically, the module directly inserts user-controlled input into SQL queries without escaping or parameterization, allowing attackers to inject malicious SQL statements via specially crafted SIP “From” headers.

This can result in database manipulation, including modification of administrator credentials and unauthorized access to the FreePBX control panel. Classified as CWE-89 (SQL Injection), the vulnerability poses a serious threat, particularly in environments that accept inbound calls from untrusted or anonymous sources.

While exploitation of the SQL injection issue may be constrained by limitations on Caller ID formatting from PSTN, systems using third-party SIP providers or accepting internet-originated calls remain at heightened risk. Both vulnerabilities require immediate attention, as they can be exploited independently or chained together for full system takeover.

Sangoma has released patches addressing these issues in UCP version 17.0.9 and missed call versions 16.0.11 and 17.0.6. Administrators are strongly advised to update the affected modules immediately, restrict access to UCP and administrative interfaces using firewall rules, and enforce strict input validation and SIP traffic filtering.

Additional defensive measures include enabling responsive firewall protections, limiting access to trusted networks, and deploying session border controllers (SBCs) to sanitize inbound signaling traffic.

Given the critical nature and low complexity of exploiting these vulnerabilities, organizations running FreePBX are urged to prioritize remediation to prevent potential large-scale compromise of their telephony infrastructure.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.