Actively exploited vulnerabilities affecting Sangoma products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2019-19006https://wildfortech.com/security#CVE-2019-19006FreePBX is a widely used web-based open-source GUI for managing Asterisk-based phone systems. This vulnerability allows attackers to bypass password authentication entirely, potentially gaining unauthorized access to the FreePBX admin interface. From there, an attacker could manipulate phone system configurations, intercept calls, redirect traffic, or pivot further into the network. Any internet-exposed FreePBX instance is at significant risk, making this a high-priority issue for organizations running VoIP infrastructure.Tue, 03 Feb 2026 00:00:00 GMTSangomaFreePBXhttps://wildfortech.com/security#CVE-2025-64328https://wildfortech.com/security#CVE-2025-64328Sangoma FreePBX Endpoint Manager contains a command injection flaw that authenticated users can exploit through the check_ssh_connect() function. Because FreePBX is widely used in business VoIP environments, a malicious insider or an attacker who has obtained valid credentials could execute arbitrary OS commands, potentially gaining remote shell access as the 'asterisk' system user — opening the door to full system compromise of the phone infrastructure.Tue, 03 Feb 2026 00:00:00 GMTSangomaFreePBX https://wildfortech.com/security#CVE-2025-57819https://wildfortech.com/security#CVE-2025-57819This vulnerability in Sangoma FreePBX allows unauthenticated attackers to bypass the login process entirely due to improper sanitization of user-supplied data. Once inside, an attacker can manipulate the underlying database and execute arbitrary code remotely. For organizations running FreePBX — a widely used open-source PBX management platform — this means full system compromise is possible without any valid credentials, making it a critical risk to phone infrastructure and potentially broader network environments.Fri, 29 Aug 2025 00:00:00 GMTSangomaFreePBX