Skip to main content
Apexward Pulse

Sangoma · Auth bypass

Sangoma FreePBX Authentication Bypass Vulnerability

CVE-2019-19006

What this means

This is rated critical severity (9.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Sangoma Freepbx is in your estate, and treat that as the priority.

Full vendor description

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Scoring and exploitation

9.8/ 10
CVSS 3.1 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~55.9% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Sangoma FreePBX

Weaknesses

CWE-287

Affected products ()

  • Sangoma Freepbx
Show the raw CPE strings (1)
  • cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*

References

10 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • Sangoma FreePBX Authentication Bypass Vulnerability

    Type Vulnerability

    Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorised users to bypass password authentication and access services provided by the FreePBX admin.

    Sangoma FreePBX
    CVE-2019-19006