Metasploit Releases 7 New Exploit Modules covering FreePBX, Cacti and SmarterMail
The recent update to the Metasploit Framework introduces significant enhancements for penetration testers, with the inclusion of seven new exploit modules targeting widely-used enterprise software.
The recent update to the Metasploit Framework introduces significant enhancements for penetration testers, with the inclusion of seven new exploit modules targeting widely-used enterprise software.
This update introduces a trio of sophisticated modules for FreePBX , as well as remote code execution (RCE) capabilities for Cacti and SmarterMail. These additions emphasize the risks associated with combining authentication bypass vulnerabilities with other flaws to achieve full system compromise.
The update includes three modules specifically targeting FreePBX, an open-source GUI managing Asterisk (PBX). Developed by researchers Noah King and msutovsky-r7, these modules chain multiple vulnerabilities, allowing escalation from unauthenticated access to remote code execution.
Initial Exploit: CVE-2025-66039 allows authentication bypass, enabling unauthorized access. SQL Injection: CVE-2025-61675 enables database manipulation through SQL injection, allowing the scheduling of arbitrary code execution. Unrestricted File Upload: CVE-2025-61678 exploits a flaw in the firmware upload function, enabling direct server control through webshell upload. Auxiliary Module: Utilizes the same SQL injection flaw to create a rogue administrator account.
Beyond VoIP, the update addresses critical vulnerabilities in network monitoring and communication platforms:
Cacti: Targets CVE-2025-24367, allowing unauthenticated RCE through the graph template mechanism in versions prior to 1.2.29. SmarterMail: Exploits CVE-2025-52691, an unauthenticated file upload vulnerability using path traversal in the guid variable, adaptable to both Windows and Linux environments.
The update enhances post-exploitation capabilities with new persistence modules. A new Burp Suite extension module allows attackers to install malicious extensions in both the Pro and Community versions. Additionally, Windows and Linux SSH key persistence have been unified into a single module.
This update introduces a trio of sophisticated modules for FreePBX , as well as remote code execution (RCE) capabilities for Cacti and SmarterMail.
Key fixes include resolving a formatting issue with hash data for John the Ripper compatibility and correcting a logic error in the SSH login scanner to ensure accurate reporting.
Module Name CVE ID Target System Impact
FreePBX Endpoint SQLi CVE-2025-66039 , CVE-2025-61675 FreePBX Remote Code Execution
FreePBX Firmware Upload CVE-2025-66039, CVE-2025-61678 FreePBX Remote Code Execution
FreePBX Admin Creation CVE-2025-66039, CVE-2025-61675 FreePBX Privilege Escalation
Cacti Graph Template RCE CVE-2025-24367 Cacti (< 1.2.29) Remote Code Execution
SmarterMail GUID Upload CVE-2025-52691 SmarterMail Remote Code Execution
Burp Extension Persistence N/A Burp Suite Persistence
SSH Key Persistence N/A Linux / Windows Persistence
Based on reporting by Cyber Security News.