FreePBX CVE-2025-59429

Requires the Asterisk HTTP status page to be network-reachable - exposed by default on FreePBX 16 via any bound IP at port 8088, but bound only to localhost by default on FreePBX 17, so default v17 installs are not remotely exploitable unless the binding is changed. Because this is reflected XSS, exploitation also requires an authenticated FreePBX administrator to actively interact with an attacker-crafted link (CVSS UI:A), making it unsuitable for silent mass automation. The attacker needs no valid FreePBX account (description states unauthenticated attackers), though this conflicts with the vector's PR:L. Limiting factors: a non-exposed or localhost-only status page (v17 default), network segmentation of port 8088, and the need to socially engineer a logged-in admin.

This is a genuine but conditional priority rather than a drop-everything emergency, and the signals must be read together because they conflict. The CVSS 4.0 base score is 8.5 (High), driven by VC:H/VI:H/VA:H, which reflects the downstream consequence of admin-session hijack rather than the direct, limited impact of the reflected XSS itself. Against that, EPSS is only 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so active or widespread exploitation is not currently indicated. A key internal inconsistency: the CVSS vector lists PR:L (privileges required), yet the description explicitly states the flaw can be exploited by unauthenticated attackers - these disagree, the PR:L is likely an artifact, and real-world exploitation appears to need no attacker authentication, only a logged-in admin victim (UI:A). Deployment context sharply changes risk: FreePBX 16 exposes the Asterisk HTTP status page by default on any bound IP at port 8088 (broadly reachable), whereas FreePBX 17 binds only to localhost by default (far less exposed). Net: treat internet-exposed FreePBX 16 instances with port 8088 reachable as high priority, while FreePBX 17 default installs are substantially lower risk. Overall this is a real, patch-worthy issue whose practical severity hinges on exposure of the status page and on luring an authenticated administrator - not a high-CVSS-but-meaningless finding, but also not yet evidenced as mass-exploited.

An attacker crafts a malicious URL targeting the Asterisk HTTP status page (port 8088) of an internet-reachable FreePBX 16 server and sends it to a logged-in administrator via phishing. When the admin opens the link, the reflected script executes in their browser and exfiltrates their FreePBX admin session cookie, which the attacker replays to take over the admin interface. No public exploit code is identified at time of analysis, and success requires the administrator to interact with the attacker-supplied link (CVSS UI:A).