Critical FreePBX Flaws Let Unauthenticated Attackers Execute Commands and Hijack Admin Accounts

Sangoma has patched two critical vulnerabilities in FreePBX that allow unauthenticated remote attackers to execute arbitrary commands and take over administrator accounts, prompting a “Red” urgency rating from the project’s security team.

Organizations running internet-facing FreePBX 16 or 17 deployments are urged to patch immediately.

The first flaw, tracked as GHSA-37j8-fhxx-9vhp, affects the User Control Panel (UCP) Node server in FreePBX 17 versions prior to 17.0.9.

The UCP server listens on port 8001 (non-TLS) or 8003 (TLS) and relies on a checkAuth middleware to authenticate socket.io connections before granting access.

Critical FreePBX Flaws

According to the advisory, changes introduced in recent socket.io v4 releases stripped away authentication protections that FreePBX depended on.

This allows an attacker with no credentials to send specially crafted socket.io events that get relayed to the Asterisk Manager Interface (AMI), resulting in arbitrary command execution as the asterisk user with zero user interaction required.

The bug carries a CVSS-B v4.0 score of 9.3 (Critical), reflecting a network-based attack vector, low complexity, no privileges or user interaction needed, and high impact to confidentiality, integrity, and availability.

Reporter mil1200 disclosed the issue, with GitHub’s chrsmj coordinating and Sangoma engineers shipping the fix in version 17.0.9. Defenders can verify their version by inspecting the UCP login page’s HTML source for the x-pjax-version meta tag.

Sangoma recommends updating immediately and, as a compensating control, enabling the FreePBX Firewall module’s Responsive Firewall feature, which restricts UCP access to IPs with successfully registered SIP endpoints.

The second advisory, GHSA-g27h-xf3q-h3rm, targets the missedcall module across both FreePBX 16 (before 16.0.11) and FreePBX 17 (before 17.0.6).

The module logs caller ID names to the database whenever a call to a monitored extension goes unanswered but it builds the INSERT query by concatenating the caller name directly into the SQL string without escaping or parameterization.

An attacker can exploit this by crafting a malicious SIP From header containing SQL injection payloads.

Because inbound Caller ID Name (CNAM) fields aren’t restricted like PSTN CNAM (limited to 15 characters), attackers using SIP trunks or direct internet calling can inject arbitrary SQL, corrupting the database and potentially modifying administrator control panel credentials to gain unauthorized access.

This flaw also scores 9.3 (Critical) on CVSS-B v4.0, though FreePBX assigned it an “Amber” urgency since the missedcall module isn’t universally deployed. Systems accepting anonymous inbound calls face the highest risk.

Restricting inbound calls to trusted SIP trunks, enforcing MFA/SAML on admin panel access, and deploying SBCs to sanitize SIP From headers before they reach FreePBX.

Both bugs stem from architectural gaps: one in third-party library behavior (socket.io), the other in unsafe query construction rather than novel attack techniques, underscoring the importance of dependency auditing and input sanitization in VoIP platforms.

Security teams should prioritize patching, audit firewall rules under Connectivity → Firewall, and review admin account activity logs for signs of prior compromise.

Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.