FreePBX Endpoint Manager CVE-2025-59051

Exploitation requires (1) a valid authenticated session to the FreePBX web interface with a KNOWN username, and (2) high/administrative privileges sufficient to reach the Endpoint Manager module's Network Scanning feature, which exposes nmap via the web UI. The concrete trigger is supplying crafted, insufficiently sanitized input to that Network Scanning function, which is passed to an OS command. Limiting factors: the PR:H requirement means an unprivileged or unauthenticated remote attacker cannot exploit this; the Endpoint Manager module (a commercial add-on) must be installed and the Network Scanning feature reachable; and affected deployments must be running Endpoint Manager 16 before 16.0.92 or 17 before 17.0.6. No user interaction by a victim is required.

Multiple signals converge on a moderate-but-real risk rather than an emergency. The CVSS 4.0 base score of 8.6 (HIGH) reflects network attack vector (AV:N), low complexity (AC:L), no attacker-side requirements (AT:N), no user interaction (UI:N), and high confidentiality/integrity impact with low availability impact (VC:H/VI:H/VA:L) - but it is explicitly gated by PR:H, meaning the attacker must already hold high (administrative) privileges in the FreePBX web interface. This single factor is the dominant risk-limiter: an outsider cannot trigger this directly. The EPSS score is low at 0.53% (43rd percentile), consistent with a vulnerability that requires authentication and is not yet being mass-exploited. There is no CISA KEV listing and no public exploit code identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation is not observed, the flaw is likely automatable once credentials exist, and technical impact is total for the asterisk service context. The signals are internally consistent - high impact offset by a high privilege precondition and low real-world exploitation probability - so this is a legitimate patch priority for FreePBX operators (especially where web admin access is broadly delegated or shared) but not a drop-everything internet-wide threat.

An attacker who has obtained valid FreePBX web admin credentials (via phishing, credential reuse, or an insider) navigates to the Endpoint Manager's Network Scanning feature and injects shell metacharacters into the user-supplied input passed to nmap. Because input is insufficiently sanitized, the crafted value is executed as an OS command in the context of the asterisk user, giving the attacker arbitrary command execution on the PBX host. No public proof-of-concept exploit was identified in the provided data, and the network attack vector with low complexity means exploitation is straightforward once authenticated.