FreePBX Fiasco: Critical Flaws Make Security Go On Vacation
Horizon3.ai has discovered multiple security vulnerabilities in FreePBX, including a critical authentication bypass flaw. By simply tinkering with a few settings, hackers could waltz right past security like it’s a revolving door. FreePBX recommends a settings overhaul and a reboot to keep unwanted guests, and their malware, out.
Hot Take:
Who knew dialing up a phone system could have you dialing up for help? FreePBX seems to have taken the “open” in open-source a bit too literally, letting hackers RSVP to your private admin panels like it’s a college frat party. Let’s hope they’re not the type to crash the place!
Key Points:
- Several vulnerabilities in FreePBX, an open-source PBX platform, have been identified.
- Critical flaw CVE-2025-66039 allows authentication bypass with specific settings.
- Authenticated SQL injection and arbitrary file upload vulnerabilities also found.
- Updates released to fix issues; users advised to modify authentication settings.
- FreePBX warns against using “webserver” authentication due to security risks.
Already a member? Log in here