Critical · published November 21, 2019
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.
🚨 A tiny oversight in Sangoma FreePBX could let anyone waltz right in, bypassing access controls completely! 🔥 Think of it like a hotel that accidentally left a few room keys unguarded in the lobby — without checking who takes them, any guest could wander into restricted areas! An attacker could exploit this access control flaw to gain unauthorized access, potentially leading to devastating consequences. This means they could tamper with configurations, eavesdrop on calls, or disrupt services, putting sensitive communications at risk!
Think of it like a hotel that accidentally left a few room keys unguarded in the lobby — without checking who takes them, any guest could wander into restricted areas! FreePBX versions 115.0.16.26 and below, 14.0.13.11 and below, and 13.0.197.13 and below lack proper access control checks, allowing malicious users to gain privileges they shouldn't have.
An attacker could exploit this access control flaw to gain unauthorized access, potentially leading to devastating consequences. This means they could tamper with configurations, eavesdrop on calls, or disrupt services, putting sensitive communications at risk! Update your FreePBX system immediately to versions 15.0.16.26 or higher, 14.0.13.12 or higher, and 13.0.197.14 or higher. Also, review your access control settings to ensure they're configured correctly! You've got this! Follow these steps to lock down your FreePBX and bolster your defenses! 🛡️