Picus Security Discovers Critical Vulnerabilities in FreePBX Systems

Picus Security has uncovered multiple critical vulnerabilities within the FreePBX platform, a widely used open-source management tool for IP PBX systems. The identified flaws, designated CVE-2025-66039, CVE-2025-61675, and CVE-2025-61678, collectively pose a significant risk, potentially allowing attackers to gain full remote control over affected systems.

FreePBX serves as a central component for many businesses' Voice over IP infrastructures. Its nature, requiring high availability and open access, makes it a prime target for threat actors. Picus Security's analysis revealed an authentication bypass vulnerability (CVE-2025-66039), multiple authenticated SQL injection flaws (CVE-2025-61675), and an authenticated arbitrary file upload vulnerability leading to Remote Code Execution (RCE) (CVE-2025-61678).

The authentication bypass (CVE-2025-66039) is a critical element, enabling attackers to circumvent login mechanisms without valid credentials. Once bypassed, this vulnerability can be chained with others, such as SQL injection or file upload exploits, to achieve complete system takeover.

The SQL injection vulnerabilities affect the Endpoint Management module, allowing attackers to manipulate the system's database. The arbitrary file upload flaw permits the insertion of malicious files, such as web shells, into the FreePBX server, enabling the execution of arbitrary code and subsequent system compromise.

Picus Security advises FreePBX users to apply necessary updates immediately and review their security configurations to mitigate these risks and protect their communication infrastructure.