CVE-2025-59056
Last modified
CVE-2025-59056 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. EPSS estimates a 0.43% chance of exploitation in the next 30 days.
Description
FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Red
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sangoma | Freepbx | >= 15.0, < 15.0.38 |
| Sangoma | Freepbx | >= 16.0, < 16.0.41 |
| Sangoma | Freepbx | >= 17.0, < 17.0.21 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-59056?
How severe is CVE-2025-59056?
How do I fix CVE-2025-59056?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59050Greenshot is an open source Windows screenshot utility. Gree…7.8
- CVE-2025-59051The FreePBX Endpoint Manager module includes a Network Scann…8.6
- CVE-2025-59052Angular is a development platform for building mobile and de…7.1
- CVE-2025-59053AIRI is a self-hosted, artificial intelligence based Grok Co…9.6
- CVE-2025-59054dstack is a software development kit (SDK) to simplify the d…8.5
- CVE-2025-59055InstantCMS is a free and open source content management syst…7.2
- CVE-2025-59057React Router is a router for React. In @remix-run/react vers…7.6
- CVE-2025-59058httpsig-rs is a Rust implementation of IETF RFC 9421 http me…5.9
- CVE-2025-59059Remote Code Execution Vulnerability in NashornScriptEngineCr…9.8
- CVE-2025-5906A vulnerability classified as critical has been found in cod…9.8
- CVE-2025-59060Hostname verification bypass issue in Apache Ranger NiFiRegi…5.3
- CVE-2025-5907A vulnerability classified as critical was found in TOTOLINK…8.8
Are you affected by CVE-2025-59056?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST