What is the CVSS score of CVE-2026-28210?

CVE-2026-28210 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Freepbx are affected by CVE-2026-28210?

FreePBX installations are vulnerable to SQL injection attacks through the Call Data Record module, potentially allowing unauthorized access to sensitive call logs and customer data.

How to fix or mitigate CVE-2026-28210?

Within 24 hours: Inventory all FreePBX instances and identify those running vulnerable versions; restrict network access to FreePBX administration interfaces to authorized personnel only. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the CDR module; disable CDR module if operationally feasible or restrict database query permissions. Within 30 days: Establish continuous monitoring for suspicious database queries; evaluate upgrade timeline to patched versions (16.0.49 or 17.0.7) once available; consider alternative PBX solutions if patch availability is delayed beyond 60 days.

Freepbx CVE-2026-28210

HIGH

SQL Injection (CWE-89)

2026-03-05 security-advisories@github.com

SQLi Freepbx Sangoma

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7.

AnalysisAI

Unauthenticated SQL injection in the FreePBX CDR module (versions before 16.0.49 and 17.0.7) allows authenticated users to execute arbitrary SQL commands and potentially compromise the entire database. An attacker with valid credentials can exploit this vulnerability to read sensitive call records, modify system data, or escalate privileges within the FreePBX system. No patch is currently available, leaving affected installations at high risk until upgrades are deployed.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Freepbx. FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.