CVE-2019-19538

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-16 · updated 2026-06-17

Description

In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege Escalation.

Affected products

Sangoma FreePBX: before 13.0.92; from 14.0.0.0 before 14.0.38.3; from 15.0.0.0 before 15.0.13.6 — fixed in 13.0.92, 14.0.38.3, 15.0.13.6

How to fix

Upgrade to a fixed version: Sangoma FreePBX 13.0.92, 14.0.38.3, 15.0.13.6. Check the vendor advisory for mitigations.

References

https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-00
https://wiki.freepbx.org/display/FOP/2019-12-03+Remote+Command+Execution
https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-00
https://wiki.freepbx.org/display/FOP/2019-12-03+Remote+Command+Execution

Get alerted when CVE-2019-19538 or the next vulnerability affects your stack