This critical vulnerability in Sangoma FreePBX allows unauthenticated remote attackers to achieve full system control and is currently being actively exploited in the wild.

This flaw is an improper authentication vulnerability (CWE-287) that permits unauthenticated remote attackers to bypass administrative authentication. Attackers can leverage this to gain full control of the PBX system, including access to call records, voicemail, and SIP credentials, often by uploading malicious PHP web shells.

Successful exploitation of this vulnerability results in a total compromise of the PBX system, leading to unauthorized access to sensitive communications, system configurations, and potential pivot points within the internal network. With a CVSS score of 9.5, the risk is extreme, as it provides attackers with the ability to intercept voice traffic and manipulate telephony services. The potential for reputational damage and data breach is significant given the critical nature of telephony infrastructure in business operations.

Immediate Action: Update the affected software to version 13.0.197.14, 14.0.13.12, 15.6.16.27 or later, or use the Module Admin feature to update the Framework module to the current version.

Proactive Monitoring: Review system logs for unauthorized access attempts, unusual administrative logins, or the presence of unexpected files in the web root, particularly PHP scripts.

Compensating Controls: Implement strict firewall rules to restrict access to the FreePBX administrative interface to known, trusted management IP addresses to prevent unauthorized remote access.

Public Exploit Available: Yes, a published PoC exists, as documented in the technical write-up provided by Check Point Research and referenced in the CVE record.

Given the confirmed active exploitation and the critical severity of this vulnerability, organizations must treat this as a top-priority security event. Immediate patching of the Framework module is required to eliminate the risk of remote administrative takeover. If patching is not immediately feasible, ensure the management interface is entirely isolated from the public internet to mitigate the threat of unauthenticated access.