CVE-2026-45562 in FreePBX
Summary
by MITRE • 09/28/2026
FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator account is required. The root cause lies in the fact that the module accepts a POST parameter that defines a custom Asterisk application, which is then stored in the database without any sanitization. Later, this data is written directly to the musiconhold_additional.conf configuration file without validation. Since Asterisk reads this configuration file and executes the specified application, an attacker can inject arbitrary commands that will be executed with Asterisk's permissions. This issue has been patched in versions 16.0.4 and 17.0.6.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified within FreePBX prior to versions 16.0.4 and 17.0.6 represents a critical server-side request forgery leading to remote code execution, specifically categorized under CWE-94 Improper Control of Generation of Code or Command Injection. This flaw resides in the Music on Hold module, which is responsible for managing audio streams played during call hold states. The core technical deficiency involves an insufficient input validation mechanism where the application accepts a POST parameter intended to define custom Asterisk applications. Instead of sanitizing this input against shell metacharacters or validating it against a whitelist of allowed commands, the system stores the raw user-supplied data directly into its database backend. This lack of encoding and filtering allows an attacker to inject arbitrary operating system commands that are subsequently written verbatim to the musiconhold_additional.conf configuration file without any further validation checks before being processed by the Asterisk telephony engine.
From a technical perspective, the exploitation chain relies on the interaction between the FreePBX web interface and the underlying Asterisk PBX service. Once an authenticated administrator submits malicious input through the Music on Hold module, the unsanitized data is persisted in the database. When the system generates or updates the musiconhold_additional.conf file to apply configuration changes, it incorporates this tainted data directly into the command execution context of Asterisk. Since Asterisk reads and executes applications defined within its configuration files with elevated privileges corresponding to the user account running the service, typically root or a dedicated asterisk user with significant system access, the injected commands are executed immediately upon reloading the module or triggering specific hold events. This architecture flaw effectively bypasses standard web application security controls by leveraging the trust relationship between the management interface and the telephony daemon.
The operational impact of this vulnerability is severe, as it grants authenticated attackers full control over the underlying operating system hosting the FreePBX instance. An attacker with valid administrator credentials can execute arbitrary commands such as creating new user accounts, installing backdoors, exfiltrating sensitive call data, or pivoting to other systems on the network. This aligns closely with MITRE ATT&CK techniques related to Command and Scripting Interpreter execution, specifically T1059, where adversaries use system utilities like sh or cmd to execute malicious code. The ability to escalate privileges from a web application context to full OS control compromises the confidentiality, integrity, and availability of the entire communication infrastructure managed by FreePBX.
Mitigation strategies primarily involve upgrading to patched versions 16.0.4 and 17.0.6 or later, which implement proper input sanitization and validation mechanisms within the Music on Hold module. Until an upgrade is feasible, administrators should restrict network access to the FreePBX web interface using firewalls and ensure that only trusted IP addresses can authenticate as administrators. Additionally, implementing strict file integrity monitoring for configuration files like musiconhold_additional.conf can help detect unauthorized modifications indicative of exploitation attempts. Regular auditing of user accounts and enforcing multi-factor authentication further reduces the risk surface by ensuring that only legitimate users with verified identities can interact with vulnerable modules.