FreePBX zero-day RCE exploited in active attacks

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Zero-day RCE in FreePBX (CVE-2025-57819) exploited in-the-wild since August 21, 2025, allows unauthenticated attackers to inject SQL, create backdoor accounts, and execute arbitrary code via authentication bypass in the Endpoint module.

Sourcelabs.watchtowr.com — open the original

watchTowr Labs disclosed CVE-2025-57819, a critical authentication bypass and SQL injection chain in FreePBX versions 16 and 17. The vulnerability resides in the commercial Endpoint module and was actively exploited in-the-wild starting August 21, 2025. Attackers exploited a flaw in FreePBX's custom class autoloader (fpbx_framework_autoloader) to bypass authentication checks and directly access module PHP files. By passing specially crafted module parameters like 'FreePBX\modules\endpoint\ajax', attackers could reach vulnerable code paths without valid session cookies. The SQL injection in the Endpoint module's brand parameter allowed attackers to manipulate the database arbitrarily, creating backdoor administrator accounts in the ampusers table. Researchers escalated this to full RCE by injecting malicious entries into the cron_jobs table, enabling command execution at regular intervals. Evidence of mass exploitation emerged when administrators reported broken installations and discovered cleanup scripts (.clean.sh) designed to wipe logs and remove web shell artifacts. The script specifically targeted references to common backdoor filenames like 'modular.php', 'monitor.php', and 'backend.php' across multiple log locations. FreePBX released emergency patches for the Endpoint module but the core authentication bypass mechanism in the framework remains unaddressed, leaving other modules potentially vulnerable. The vulnerability impacts FreePBX deployments exposed to the internet without IP filtering, representing a significant risk to VoIP infrastructure including access to call recordings, voicemails, and potentially lawful intercept systems.

title: Web Shell Dropped in FreePBX Module Directory via Web Server Process
id: 8483a998-ad9a-5982-a3b0-949462f76ebd
status: experimental
description: Detects creation of PHP files with names matching known FreePBX backdoor
  artefacts (modular.php, monitor.php, backend.php) by a web server or Asterisk process,
  consistent with CVE-2025-57819 webshell deployment.
references:
- watchTowr Labs CVE-2025-57819 disclosure
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|contains:
    - httpd
    - apache2
    - php-fpm
    - asterisk
    - nginx
    TargetFilename|endswith:
    - /modular.php
    - /monitor.php
    - /backend.php
  condition: selection
falsepositives:
- Legitimate FreePBX module updates or third-party addon packages that legitimately
  use similarly named files (verify against official module manifests)
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

title: Log Cleanup Script Removing Web Shell References (FreePBX .clean.sh Pattern)
id: 642d05bb-7f7f-593a-bb01-32b08f74aac3
status: experimental
description: Detects execution of a cleanup script or inline shell commands that strip
  references to known backdoor filenames from log files, matching the .clean.sh anti-forensic
  pattern seen after FreePBX CVE-2025-57819 exploitation.
references:
- watchTowr Labs CVE-2025-57819 disclosure
logsource:
  category: process_creation
  product: linux
detection:
  selection_script:
    CommandLine|contains: .clean.sh
  selection_inline:
    CommandLine|contains|all:
    - sed
    - -i
    CommandLine|contains:
    - modular.php
    - monitor.php
    - backend.php
  condition: 1 of selection_*
falsepositives:
- Legitimate administrator log rotation or cleanup scripts that happen to reference
  similar filenames during incident response
level: high
tags:
- attack.t1685.006
- attack.t1190
author: Vorant

title: Web Server or Asterisk Process Spawning Shell Consistent with FreePBX RCE Chain
id: 96107b4a-0d03-5ab0-a6de-8627dec02f10
status: experimental
description: Detects a shell or crontab-manipulating process spawned as a child of
  a web server, PHP-FPM, or Asterisk process, consistent with RCE achieved via malicious
  cron_jobs table entries injected through the FreePBX Endpoint module SQL injection
  chain.
references:
- watchTowr Labs CVE-2025-57819 disclosure
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - httpd
    - apache2
    - php-fpm
    - nginx
    - asterisk
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /crontab
  selection_cron_context:
    CommandLine|contains:
    - cron
    - /etc/cron
    - /var/spool/cron
  condition: selection_parent and selection_child and selection_cron_context
falsepositives:
- FreePBX's own scheduled fwconsole cron regeneration jobs that legitimately rewrite
  crontab entries from the cron_jobs table (baseline expected regeneration commands
  and users)
level: medium
tags:
- attack.t1053.003
- attack.t1190
author: Vorant

Source reporting: https://labs.watchtowr.com/you-already-have-our-personal-data-take-our-phone-calls-too-freepbx-cve-2025-57819/

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.