An improper access control vulnerability in the FreePBX framework allows low-privileged users to modify sensitive system configurations, posing a risk of unauthorized control.

This vulnerability involves external control of system or configuration settings (CWE-15). It allows an attacker with low-level privileges to gain unauthorized control over configuration aspects of the IP PBX, impacting system integrity.

An attacker could potentially alter call routing, compromise system settings, or facilitate further unauthorized access to the telecommunications infrastructure. The CVSS score of 8.6 highlights the critical nature of this configuration bypass, which could lead to significant operational disruption.

Immediate Action: Update the FreePBX framework to the latest version (16.0.47 or 17.0.30) to resolve the configuration control vulnerability.

Proactive Monitoring: Monitor system configuration logs for unexpected changes and investigate any unauthorized modification attempts made by low-privileged user accounts.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the capabilities of low-privileged users within the management interface.

Public Exploit Available: Unknown

Given the central role of the framework in the FreePBX ecosystem, this vulnerability should be addressed immediately. Administrators must ensure that the framework is updated to the specified versions to prevent unauthorized configuration changes and maintain system integrity.