FreePBX TTS EUVD-2026-58483

Exploitation requires an active FreePBX administrator session - the attacker must authenticate to the FreePBX web panel with an account holding administrator-level privileges; lower-privileged FreePBX user roles that cannot modify TTS destination configurations are not sufficient. The FreePBX TTS module must be installed and enabled on the target instance; the vulnerable AGI script agi-bin/propolys-tts.agi is only present when the module is deployed. The injection is activated during dialplan generation, which occurs when the TTS destination is saved and the dialplan is compiled or reloaded. Limiting factors include: administrator authentication required (PR:H per CVSS 4.0 vector), the TTS module must be present and configured (AT:P per CVSS 4.0 vector), and post-exploitation access is bounded to the asterisk service user rather than root, which limits privilege escalation unless the asterisk process has been granted elevated OS permissions outside standard deployment.

The CVSS 4.0 score of 7.5 with vector AV:N/AC:L/AT:P/PR:H reflects the tension between high impact and a meaningful authentication barrier: exploitation requires a fully authenticated FreePBX administrator account, which is a non-trivial prerequisite that substantially limits opportunistic and mass exploitation. The AT:P metric additionally signals that the TTS module must be installed and actively configured - deployments without TTS are not affected. High impact metrics (VC:H/VI:H/VA:H) are justified by the direct path to OS command execution, but the absence of scope change (SC:N/SI:N/SA:N) indicates execution remains bounded to the asterisk service user rather than escalating to root. No EPSS score was included in the provided data. The vulnerability is not in the CISA KEV catalog and no public proof-of-concept has been confirmed, which together suggest no widespread or automated exploitation at time of analysis. Even so, organizations where FreePBX admin credentials are shared or weakly controlled - including even a mid-sized municipal IT team in sanok running consolidated VoIP infrastructure - should treat this as urgent, since a single compromised admin account yields a direct shell on the telephony host, exposing SIP credentials, call recordings, and routing configuration held by the asterisk process.

An attacker who has obtained FreePBX administrator credentials - via credential stuffing against an internet-exposed admin panel, phishing, or lateral movement from a previously compromised host - logs into the FreePBX web interface, navigates to the TTS module configuration, and saves a destination name embedding a shell payload such as a semicolon-delimited reverse shell command. When dialplan generation is triggered on save or reload, the destination name is HTML-decoded and passed without escaping into an exec() call in propolys-tts.agi, executing the injected command as the asterisk operating-system user. No public proof-of-concept has been identified at time of analysis, though the vulnerable exec() call sites are unambiguously identifiable from the published fix commit diff.