What’s Vulnerable › Vulnerabilities
CVE-2025-59051: FreePBX Endpoint Manager command injection via Network Scanning feature
- Severity: high (CVSS 8.6 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-10-14 · updated 2026-10-08
- Weakness: CWE-78
Description
The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. Updating to Endpoint Manager 16.0.92 or 17.0.6 addresses the issue.
Affected products
- FreePBX endpoint: before 16.0.92; from 17.0.0, < 17.0.6
References
Get alerted when CVE-2025-59051 or the next vulnerability affects your stack