This critical vulnerability allows unauthenticated attackers to achieve remote code execution on Sangoma FreePBX systems and is currently being actively exploited in the wild.

The application fails to properly sanitize user-supplied data, resulting in SQL injection (CWE-89) and authentication bypass (CWE-288) flaws. These vulnerabilities permit an unauthenticated remote attacker to gain administrative access to the FreePBX interface and execute arbitrary code on the underlying system.

With a CVSS score of 9.5, this vulnerability represents a critical risk to organizational infrastructure. Successful exploitation grants an attacker full control over the telephony server, potentially leading to unauthorized system access, data exfiltration, complete service disruption, and lateral movement within the internal network. Given the active exploitation observed in the wild, the business risk of inaction is extremely high.

Immediate Action: Update the FreePBX endpoint software to versions 15.0.66, 16.0.89, or 17.0.3 immediately.

Proactive Monitoring: Monitor system logs for unauthorized administrative login attempts and inspect database query logs for suspicious SQL injection patterns or unexpected administrative modifications.

Compensating Controls: Implement strict network access controls to restrict access to the FreePBX administrative interface to trusted internal IP addresses and deploy a Web Application Firewall (WAF) to filter malicious requests targeting the known vulnerable endpoints.

Public Exploit Available: Yes, a Metasploit module and multiple public proof-of-concept repositories are available.

Due to the critical nature of this vulnerability and confirmed active exploitation, organizations must prioritize patching their FreePBX instances without delay. If patching is not immediately feasible, the system should be isolated from the public internet to prevent unauthorized remote access. Testing and deploying the provided security updates is the only definitive method to mitigate the risk of compromise.