CVE-2025-59051

The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. Updating to Endpoint Manager 16.0.92 or 17.0.6 addresses the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-qgj3-f9gj-98v9

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El módulo FreePBX Endpoint Manager incluye una función de escaneo de red que proporciona acceso basado en web a la funcionalidad de nmap para el descubrimiento de dispositivos de red. En Endpoint Manager 16 anterior a 16.0.92 y 17 anterior a 17.0.6, la entrada proporcionada por el usuario insuficientemente saneada permite la ejecución autenticada de comandos del sistema operativo como el usuario asterisk. Se requiere autenticación con un nombre de usuario conocido. La actualización a Endpoint Manager 16.0.92 o 17.0.6 aborda el problema.

Information

Published : 2025-10-14 20:15

Updated : 2026-10-08 12:10

NVD link : CVE-2025-59051

Mitre link : CVE-2025-59051

CVE.ORG link : CVE-2025-59051

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-59051", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59051", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-14T19:28:21.493347Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FreePBX", "product": "endpoint", "versions": [{"status": "affected", "version": "< 16.0.92"}, {"status": "affected", "version": ">= 17.0.0, < 17.0.6"}]}]}], "published": "2025-10-14T20:15:43.193", "references": [{"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-qgj3-f9gj-98v9", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. Updating to Endpoint Manager 16.0.92 or 17.0.6 addresses the issue."}, {"lang": "es", "value": "El m\u00f3dulo FreePBX Endpoint Manager incluye una funci\u00f3n de escaneo de red que proporciona acceso basado en web a la funcionalidad de nmap para el descubrimiento de dispositivos de red. En Endpoint Manager 16 anterior a 16.0.92 y 17 anterior a 17.0.6, la entrada proporcionada por el usuario insuficientemente saneada permite la ejecuci\u00f3n autenticada de comandos del sistema operativo como el usuario asterisk. Se requiere autenticaci\u00f3n con un nombre de usuario conocido. La actualizaci\u00f3n a Endpoint Manager 16.0.92 o 17.0.6 aborda el problema."}], "lastModified": "2026-10-08T12:10:00.217", "sourceIdentifier": "security-advisories@github.com"}