FreePBX CVE-2026-73663

Exploitation requires that the FreePBX 'missedcall' module be installed and that the target system can receive an inbound SIP call which reaches a monitored extension; the attacker must control the Caller ID name (SIP From-header display name), which is trivial to spoof on many SIP trunks. The specific trigger is that the call must go UNANSWERED so the missed-call notification path (agi-bin/missedcallnotify.php) executes the vulnerable INSERT. No authentication is required (CVSS PR:N confirms unauthenticated). Limiting factors: the injection does not fire on answered calls, the missedcall module must be present and configured with at least one monitored extension, only affected versions (16.0.0-16.0.10, 17.0.0-17.0.3) are vulnerable, and the attacker needs a route to deliver a SIP call with an arbitrary From display name to the PBX.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H (9.3) indicates fully remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact on the vulnerable system, and the description independently corroborates this - an unauthenticated caller triggers the flaw simply by placing a call. The one nuance limiting fully automated mass exploitation is the trigger condition: the injection fires only when a monitored extension goes unanswered, so an attacker must place a call that rings out rather than hitting an endpoint directly. No EPSS score, KEV entry, or published POC is present in the provided data, so exploitation is currently theoretical-but-straightforward; the public fixing commits materially lower the bar to weaponization by disclosing the exact vulnerable sink. Absence of EPSS/KEV data means real-world exploitation prevalence is unknown, not zero - treat as urgent given the low skill required and the stated outcome of administrator account takeover.

An attacker places an inbound SIP call to the target FreePBX system with a maliciously crafted Caller ID name (SIP From display name) containing SQL syntax, and lets the call ring a monitored extension until it goes unanswered. When missedcallnotify.php logs the missed call, the injected SQL executes against the FreePBX database, allowing the attacker to modify an administrator account and subsequently log into the web GUI for full control. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), though no public POC is identified at time of analysis.