github.comConfirmation
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-qgj3-f9gj-98v9 CVE-2025-59051
HIGH
FreePBX Endpoint Manager command injection via Network Scanning feature
Record summary
CVE-2025-59051 has a selected CVSS score of 8.6 (high).
Description
The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. Updating to Endpoint Manager 16.0.92 or 17.0.6 addresses the issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 14, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
endpointBrowse FreePBX / endpoint | CVE List | < 16.0.92 | affected |
| >= 17.0.0, < 17.0.6 | affected |