Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

FreePBX Vulnerabilities Enables Authentication Bypass that Leads Remote Code Execution

## Cybersecurity: FreePBX Vulnerabilities and Mitigation

HBy Heather LyonsDec 16, 20252 min read

Cybersecurity: FreePBX Vulnerabilities and Mitigation

FreePBX has addressed critical vulnerabilities in its Endpoint Manager module that allowed for authentication bypass and remote code execution. These issues, identified by Horizon3.ai researchers, affect telephony endpoint configurations in the open-source IP PBX system.

Researchers discovered three high-severity vulnerabilities:

CVE-2025-66039: Allows authentication bypass when the "webserver" authorization type is enabled, permitting forged Basic Auth headers to access protected endpoints. CVE-2025-61675: Involves multiple SQL injections across various endpoints, affecting 11 parameters for database read/write access. CVE-2025-61678: Enables arbitrary file uploads via the firmware endpoint, allowing PHP webshell deployment for command execution.

The vulnerabilities collectively enable unauthenticated attackers to execute arbitrary code on vulnerable instances, posing significant risks to business communication infrastructure.

The authentication bypass vulnerability (CVE-2025-66039) affects FreePBX deployments configured with webserver-type authentication. Attackers can forge an Authorization header with Basic HTTP authentication credentials, bypassing security checks that rely on Apache-level verification.

FreePBX has addressed critical vulnerabilities in its Endpoint Manager module that allowed for authentication bypass and remote code execution.
Heather Lyons · Thehackingpost

The second vulnerability (CVE-2025-61675) involves SQL injection, affecting four unique endpoints and eleven parameters, allowing attackers to read, modify, or delete database entries. These SQL injections enable malicious actors to insert administrative users into the ampusers table or execute operating system commands through the cron_jobs table.

The third vulnerability (CVE-2025-61678) involves an arbitrary-file-upload vulnerability in the firmware upload functionality. Attackers can manipulate file paths and upload PHP webshells without proper validation, resulting in unauthenticated remote code execution.

FreePBX has released patches addressing all three vulnerabilities. Organizations using versions 16.x or 17.x should update immediately to:

Version 16.0.92 and 17.0.6 for SQL injection and file upload issues. Version 16.0.42 and 17.0.22 for the authentication bypass.

Advertisement

Additionally, FreePBX has removed the web server authentication option from the UI, requiring manual configuration via the command line, and now triggers dashboard warnings when enabled.

Horizon3.ai researchers recommend auditing FreePBX instances for suspicious database entries, unauthorized users in the ampusers table, and suspicious files in the /var/www/html directory. They advise against using web server authentication due to its reliance on legacy code and weaker security mechanisms.

For further details and guidance, consult the official FreePBX documentation and ensure all systems are promptly updated.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026