FreePBX EUVD-2026-33298

Exploitation requires an authenticated session on the FreePBX Administration Control Panel with the CDR section permission enabled in User Management; full administrator privileges are explicitly not required per the advisory. The vulnerable code path is the CDR Reports module page, triggered by attacker-controlled values in the order and sort POST parameters, so network reachability of the FreePBX admin web interface (default HTTP/HTTPS on the management VLAN, often exposed to the internet in SMB/MSP deployments) is also required. Limiting factors that reduce realistic risk: the PR:H authentication requirement, the need for the target FreePBX instance to be running an unpatched 16.x (<16.0.50) or 17.x (<17.0.11) build of the security-reporting module, and the need for the compromised account to have been granted CDR access rather than being scoped to other sections such as Extensions or Trunks.

Signals are mixed and point to a meaningful but not critical priority. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N yields 8.5 because exploitation is network-reachable with low complexity and high confidentiality/integrity impact, but the PR:H requirement (an authenticated FreePBX admin panel account with CDR access) substantially narrows the attacker population - typically internal staff, MSP technicians, or attackers who have already pivoted via credential theft or a separate auth bypass. No EPSS score, KEV listing, or public POC was provided in the intelligence, so this is no public exploit identified at time of analysis rather than confirmed actively exploited. The note worth flagging: FreePBX admin panels are frequently exposed to the internet on default ports and have a history of credential-stuffing and chained authentication-bypass exploitation, so PR:H should not be treated as fully mitigating in real-world deployments - verify exposure of the admin UI before deprioritizing.

An attacker who has obtained or been granted a low-tier FreePBX admin account with CDR section access - for example a help-desk technician account, a stolen MSP credential, or a credential harvested via phishing - logs into the Administration Control Panel and submits a crafted POST request to the CDR Reports page with a malicious payload in the order or sort parameter. The injected SQL is executed against the asteriskcdrdb (and via the same database user, often other FreePBX databases), allowing the attacker to exfiltrate call detail records, voicemail metadata, SIP credentials stored in the asterisk database, and the ampuser password hashes used for the admin panel itself. No public exploit is identified at time of analysis, but the injection sink is straightforward and a working PoC would be trivial to develop from the advisory.