Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck
CVE-2024-58294FreePBX 16 Authenticated Remote Code Execution via API Module
High 8.7
In plain English
A high-severity OS command injection in FreePBX from FreePBX. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)3.6%top 10.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- ExploitDB-52031 exploit
- Official Product Homepage product
- Original Video Link product
- VulnCheck Advisory: FreePBX 16 Authenticated Remote Code Execution via API Module third-party-advisory