{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:10:31.291Z",
  "tag": {
    "id": "freepbx",
    "label": "FreePBX",
    "isStack": false,
    "url": "https://pwn.watch/t/freepbx",
    "feed": "https://pwn.watch/t/freepbx/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "sangoma-freepbx-cve-2025-64328",
      "title": "Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-64328",
      "json": "https://pwn.watch/i/sangoma-freepbx-cve-2025-64328.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Sangoma FreePBX ",
      "tags": [
        "sangoma",
        "freepbx",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-64328"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-02-03",
      "closedAt": "2026-02-03",
      "updatedAt": "2026-02-03",
      "summary": "Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Added to CISA KEV on 2026-02-03.",
      "xPost": null
    },
    {
      "slug": "sangoma-freepbx-cve-2025-57819",
      "title": "Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability",
      "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819",
      "json": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Sangoma FreePBX",
      "tags": [
        "sangoma",
        "freepbx",
        "cisa-kev",
        "rce",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2025-57819"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-08-29",
      "closedAt": "2025-08-29",
      "updatedAt": "2025-08-29",
      "summary": "Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Added to CISA KEV on 2025-08-29.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "sangoma-freepbx-cve-2025-64328",
      "incidentTitle": "Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-02-03",
      "title": "CISA added CVE-2025-64328 to the KEV catalog (due 2026-02-24).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-64328"
    },
    {
      "incident": "sangoma-freepbx-cve-2025-57819",
      "incidentTitle": "Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-29",
      "title": "CISA added CVE-2025-57819 to the KEV catalog (due 2025-09-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819"
    }
  ]
}