FreePBX, a widely deployed open-source IP PBX management tool, serves as a critical component in Voice over IP (VoIP) infrastructures for businesses globally. Due to its role in managing communications, these systems often require high availability and relatively open access, making them attractive targets for threat actors.
Recent security assessments have identified multiple critical vulnerabilities within the FreePBX ecosystem. These include an authentication bypass vulnerability (CVE-2025-66039), multiple authenticated SQL injection flaws (CVE-2025-61675), and an authenticated arbitrary file upload vulnerability leading to Remote Code Execution (RCE) (CVE-2025-61678). While some of these flaws technically require authentication, the discovery of the authentication bypass mechanism allows unauthenticated attackers to chain these vulnerabilities, effectively granting full remote control over the target system.
FreePBX functions as the central node of a complex telecommunications ecosystem, bridging connections between the PSTN, ITSP, and SIP trunks.
Beyond these network links, the system manages a diverse range of endpoints, including analog and digital gateways, physical phones, and various software clients for desktop or mobile users. Because accommodating this extensive connectivity requires keeping multiple interfaces open to external networks and remote users, the appliance inherently faces a significantly expanded potential attack surface.
The most critical link in this kill chain is CVE-2025-66039, an authentication bypass vulnerability affecting the "webserver" authentication type configuration in FreePBX.
FreePBX supports multiple authentication mechanisms, configured via "Advanced Settings." Options include database, none, usermanager, and webserver. The vulnerability resides specifically within the webserver authentication flow. This method delegates authentication security to the Apache web server layer.
Analysis of the gui_auth.php file revealed a flaw in how the application handles session creation when this mode is active. The application checks for the PHP_AUTH_USER key in the server variables.
|
case 'webserver': |
If an attacker sends a request with a valid username (e.g., admin) in the Authorization header, FreePBX initializes a session for that user without verifying the password. This allows for complete bypass of the authentication mechanism.
Following the authentication bypass, or with valid credentials, multiple SQL injection (SQLi) vulnerabilities were identified within the Endpoint Management module. These flaws allow attackers to read from or write to the database.
It was observed that 4 unique views and 11 parameters are affected. These views are basestation, firmware, basefile, and customExt. The combination of view (customExt) and parameter (id) shown below allows you to insert users into a table:
|
POST /admin/config.php?display=endpoint&view=customExt&new=1 HTTP/1.1 |
Vulnerable parameters for each view are shown below [1]:
|
View Parameters basestation name, brand, template, ac |
With authentication bypassed, attackers can leverage the Endpoint Manager Custom Firmware Management feature to upload malicious files.
The upload_cust_fw argument in this feature is intended for uploading phone firmware. However, it was observed that the application fails to adequately validate the file content or the destination path. The vulnerability is exploited in two steps:
The upload request is shown below:
|
POST /admin/ajax.php?module=endpoint&command=upload_cust_fw HTTP/1.1 |
Upon successful upload, the webshell is accessible at /webshell.php. An attacker can then execute arbitrary system commands. An example command to read the /etc/passwd file on the target server is shown below:
|
GET /webshell.php?cmd=cat+/etc/passwd HTTP/1.1 |
The response proves the exploitation was successful:
|
root:x:0:0:root:/root:/bin/bash |
We also strongly suggest simulating the FreePBX CVE-2025-61675 vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Security Validation Platform. You can also test your defenses against other vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.
Picus Threat Library includes the following threats for FreePBX CVE-2025-61675 vulnerability exploitation attacks:
|
Threat ID |
Threat Name |
Attack Module |
|
84335 |
FreePBX Web Attack Campaign |
Web Application |
Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.
References
[1] The Hacker News, “FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE,” The Hacker News. Accessed: Jan. 12, 2026. [Online]. Available: https://thehackernews.com/2025/12/freepbx-authentication-bypass-exposed.html