FreePBX Vulnerabilities Enable Unauthenticated RCE and Administrator Takeover
Do Son 
TL;DR
Two new FreePBX vulnerabilities each carry a CVSS score of 9.3. One gives unauthenticated remote code execution through the UCP module. The other is a SQL injection that can hand an attacker administrator takeover. No public exploit or in-the-wild abuse has been confirmed yet.
Why it matters
FreePBX runs many business phone systems on top of Asterisk. These FreePBX vulnerabilities need no login to exploit. An internet-facing server with a weak firewall is at direct risk. The provider set the UCP flaw to its highest “Red” urgency. Both bugs can lead to full server control or a hijacked admin panel. The missedcall flaw carries a lower “Amber” urgency, yet it still risks admin control.
How the attacks work
UCP unauthenticated RCE
The UCP Node server listens on ports 8001 and 8003 by default. It checked socket.io logins with an auth guard. However, recent socket.io changes weakened that protection. As a result, an unauthenticated client can send crafted events. Those events reach the Asterisk Manager Interface and run commands as the asterisk user. Full details appear in the UCP RCE advisory.
missedcall SQL injection
The missedcall module logs each unanswered caller’s name to the database. It drops that name into the SQL query without escaping. So a crafted SIP caller-ID name can inject SQL. That injection can rewrite admin control-panel accounts, which leads to administrator takeover. Systems that accept anonymous internet calls face the most risk. The missedcall advisory has the specifics. We are not publishing any payloads.
Affected versions
The UCP flaw affects FreePBX ucp before 17.0.9. The missedcall flaw affects versions before 16.0.11 and 17.0.6. Patched releases are ucp 17.0.9, and missedcall 16.0.11 and 17.0.6. FreePBX shipped both fixes on July 17, 2026.
Patch and mitigation
Update both modules right away. Then lock down the UCP ports with the FreePBX Responsive Firewall. Also restrict inbound calls to trusted SIP trunks only. Protect the admin panel with VPN or MFA as well. For the caller-ID bug, overwrite the incoming name in your dialplan. An SBC in front of FreePBX can also filter hostile SIP headers. The Canadian Cyber Centre echoed these steps in its own alert.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
