Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-31 | 2 | Exploit2 |
| 2026-02-01 | 1 | Exploit1 |
| 2026-02-20 | 2 | Disclosure1General1 |
| 2026-03-19 | 1 | General1 |
| 2026-04-01 | 1 | General1 |
https://cybersec.picussecurity.com/s/critical-freepbx-vulnerabilities-cve-2025-66039-cve-2025-61675-cve-2025-61675-25487/1 Critical FreePBX Vulnerabilities: CVE-2025-66039, CVE-2025-61675, CVE-2025-61675
Post summary
The text merely lists three CVE identifiers for Critical FreePBX vulnerabilities, offering no additional information or context.
''The FreePBX Rabbit Hole: CVE-2025-66039 & More'' #infosec #pentest #redteam #blueteam https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/
Post summary
The tweet merely announces a link to an article about FreePBX vulnerabilities, providing no concrete details or actionable information.
The FreePBX Rabbit Hole: CVE-2025-66039 and others #FreePBX #Vulnerabilities #CVE202566039 #RCE #SQLInjection https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/
Post summary
The tweet points to an article on multiple FreePBX vulnerabilities, including CVE-2025-66039 with RCE and SQL injection potential, but provides no details on exploitation, patches, or real‑world usage.
🛠️ Metasploit Update Adds 7 New Modules for FreePBX Chains, Cacti and SmarterMail Metasploit Framework has published its January 30, 2026 weekly wrap up, adding seven new modules alongside a set of fixes. Three of the new modules target FreePBX by chaining CVE-2025-66039 with additional flaws to reach remote code execution, while new exploit modules were added for Cacti and SmarterMail. The release also includes two persistence modules and multiple fixes affecting credential handling and scanner reporting. Read: https://hackeraffairs.com/metasploit-update-adds-7-new-modules-for-freepbx-chains-cacti-and-smartermail/
Post summary
Metasploit released new exploit modules targeting FreePBX (via CVE‑2025‑66039), Cacti, and SmarterMail, providing functional code but with no evidence of active exploitation in the wild.
#FreePBX is a popular open-source IP PBX management tool. @FreePBX manages #VoIP communications & requires high availability & relatively open access, making it a very attractive target for threat actors. It now has serious CVE vulns. HT @PicusSecurity https://cybersec.picussecurity.com/s/critical-freepbx-vulnerabilities-cve-2025-66039-cve-2025-61675-cve-2025-61675-25485
Post summary
The tweet announces that FreePBX has been found to have serious CVE vulnerabilities, linking to a security blog for additional details.
🚨 New Metasploit Modules Weaponize Critical FreePBX, Cacti, and SmarterMail Flaws (Unauth RCE + Persistence) Metasploit 6.4.111 added seven modules chaining FreePBX auth bypass (CVE-2025-66039) with SQLi (CVE-2025-61675) or unrestricted upload (CVE-2025-61678) for unauth RCE, plus unauth RCE in Cacti <1.2.29 (CVE-2025-24367) and SmarterMail path traversal/file upload (CVE-2025-52691), alongside new persistence modules (Burp extension + SSH key injection). This matters because exploitation is now “push-button,” making rapid patching/segmentation and exposure validation urgent for internet-facing VoIP, monitoring, and mail servers. 🎯 Target: Global/Enterprise IT #️⃣ Category: #Vulnerability #BlueTeam 🔗 URL: https://cyberpress.org/metasploit-modules-target-freepbx-cacti-smartermail/
Post summary
The post announces newly available Metasploit modules that enable push‑button exploitation of several critical CVEs in FreePBX, Cacti, and SmarterMail, emphasizing functional exploit code but not claiming active attacks.
🚨 Metasploit Adds 7 Fresh Exploit Modules Targeting FreePBX, Cacti, and SmarterMail (Unauth RCE Chains) This Metasploit update ships new modules chaining FreePBX auth-bypass (CVE-2025-66039) with SQLi (CVE-2025-61675) or unrestricted upload (CVE-2025-61678) to reach unauth RCE, plus unauth RCE for Cacti <1.2.29 (CVE-2025-24367) and SmarterMail file upload/path traversal (CVE-2025-52691) to drop webshells/cron-based persistence. This matters because defenders can immediately validate exposure and prioritize patching/hardening for widely deployed VoIP, monitoring, and mail systems. 🎯 Target: Global/Enterprise IT #️⃣ Category: #Vulnerability #BlueTeam 🔗 URL: https://cybersecuritynews.com/metasploit-exploit-modules/
Post summary
Metasploit has released seven new modules chaining multiple CVEs to achieve unauthenticated RCE and persistence, enabling defenders to test exposure and prioritize patching.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sangoma | freepbx | - | - | - |