CVE-2026-73664 in FreePBX
Summary
by MITRE • 08/14/2026
FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized_keys for the asterisk system user without reliably enforcing backup-only command and source restrictions. The key grants persistent shell access that can execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services. This issue is fixed in version 17.0.11.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability exists within the FreePBX IP PBX system where the publicKeySave AJAX endpoint in Backup.class.php presents a critical privilege escalation risk. This flaw affects versions ranging from 17.0.5.34 through 17.0.10, creating an insecure direct object reference condition that allows authenticated administrators to inject SSH public keys into the system's authorized_keys file. The technical implementation fails to enforce proper command restrictions and source limitations on the injected key, resulting in a persistent backdoor that grants full system access.
The operational impact of this vulnerability extends far beyond simple unauthorized access, creating a comprehensive attack surface that enables adversaries to execute arbitrary commands with elevated privileges. Once the malicious SSH key is appended to /home/asterisk/.ssh/authorized_keys, the attacker gains persistent shell access to the asterisk system user account, which possesses extensive permissions within the FreePBX environment. This access allows for complete system compromise including modification of system files, disruption of telephony services, and unauthorized access to sensitive call data and configuration information.
The vulnerability directly maps to CWE-269 Improper Privilege Management and CWE-287 Improper Authentication, as it involves unauthorized privilege escalation through improper enforcement of access controls. From an adversarial perspective, this represents a critical weakness that aligns with ATT&CK technique T1543.003 Create or Modify System Process for persistence mechanisms. The attack surface is particularly concerning because the asterisk user typically has broad system privileges necessary for telephony operations, making this compromise potentially devastating to both system integrity and business continuity.
Mitigation strategies should focus on immediate patching to version 17.0.11 or later where the vulnerability has been addressed through proper enforcement of command restrictions and source limitations. Administrators should implement network segmentation to limit access to administrative interfaces and enforce multi-factor authentication for all administrator accounts. Additional defensive measures include monitoring SSH authentication logs for unauthorized key additions, implementing strict file permissions on authorized_keys files, and conducting regular security audits of system user configurations. Organizations should also consider implementing principle of least privilege enforcement and regular vulnerability scanning to detect similar insecure configurations across their telephony infrastructure.