CVE-2019-19006

What Is FreePBX?

FreePBX is a widely used open-source web GUI for managing Asterisk-based PBX (private branch exchange) telephone systems. It is deployed by businesses, call centers, and VoIP providers to configure extensions, trunks, call routing, and voicemail. The FreePBX administrator panel controls the entire phone system, so unauthorized access to it can lead to toll fraud, call interception, and — since Asterisk configuration changes can include shell-executed hooks — a path to remote code execution on the underlying server.

Overview

CVE-2019-19006 is a critical improper authentication vulnerability (CWE-287) in FreePBX that allows an unauthenticated remote attacker to bypass password authentication and reach functionality intended only for authenticated FreePBX administrators. With a CVSS score of 9.8, it grants full administrative control of the phone system to anyone who can reach the web interface.

Technical Details

The flaw lies in how FreePBX validates administrator sessions/credentials for certain endpoints, allowing a specially crafted request to be treated as already authenticated without supplying valid credentials. Once bypassed, an attacker gains access to the same administrative functionality a legitimate FreePBX admin would have — including modules that can be used to modify dialplan/configuration in ways that lead to arbitrary command execution on the host, since Asterisk configuration supports executing external scripts.

The attack requires only network access to the FreePBX admin interface (commonly exposed on port 80/443 or a dedicated admin port), no credentials, and no user interaction — a single crafted HTTP request is sufficient to reach the bypass.

Discovery

Sangoma disclosed and patched this issue through its own security advisory process, publishing a hotfix on November 20, 2019 alongside details of the remote admin authentication bypass.

Exploitation Context

This vulnerability sat largely dormant from a KEV perspective for years before CISA added it to the catalog in February 2026, confirming that unpatched FreePBX instances are still being actively targeted more than six years after the original advisory — a reminder that internet-exposed PBX administration panels remain a persistent target for toll fraud and infrastructure compromise campaigns.

Remediation

1. Apply the Sangoma hotfix referenced in the November 20, 2019 advisory, or upgrade to a current, supported FreePBX release.
2. Never expose the FreePBX admin interface directly to the internet — place it behind a VPN or restrict access via IP allowlisting/firewall rules.
3. Audit FreePBX configuration for unauthorized changes to extensions, trunks, or dialplan modules that could indicate prior compromise.
4. Review call detail records (CDRs) for unexpected international or premium-rate calls, a common sign of toll fraud following PBX compromise.
5. Enable and monitor FreePBX/Asterisk logs for authentication anomalies and repeated access attempts to admin endpoints.