FreePBX Music EUVD-2026-58485

Exploitation requires an authenticated session with administrative access to the FreePBX Music on Hold module specifically. The CVSS 4.0 AT:P (Attack Target: Presence) metric captures the additional prerequisite that the Music on Hold configuration must reference a custom player binary (such as /usr/bin/mpg123 or /usr/bin/cvlc) rather than relying on built-in default playback - environments using only default hold music configurations are not reachable via this path. The attacker must be able to submit or modify the custom player command-line arguments through the FreePBX web interface and have those changes applied. Limiting factors include: the FreePBX admin interface is typically not exposed to the public internet in security-aware deployments, so network reachability is itself a prerequisite in most environments; successful exploitation yields only asterisk service user privileges rather than root, restricting the blast radius to files and sockets accessible to that account; and the attack requires deliberate submission of a crafted configuration through the admin UI rather than a passive, automated, or drive-by trigger.

The CVSS 4.0 score of 7.6 (High) reflects real but bounded risk. AV:N places the attack surface on the network-accessible FreePBX web interface, AC:L indicates low exploitation complexity once prerequisites are met, and AT:P explicitly captures a required precondition - the Music on Hold module must be configured with a custom player rather than the built-in default. PR:L indicates module-level authenticated access is required, which meaningfully constrains the attacker pool compared to an unauthenticated flaw. VC:H and VI:H confirm high confidentiality and integrity impact within the asterisk service user context, but SC:N/SI:N/SA:N indicate no direct impact on subsequent systems, limiting lateral movement potential. No CISA KEV listing and no public POC have been identified, which distinguishes this from imminently mass-exploitable threats - even a mid-sized municipal IT team in olsztyn should treat this as urgent scheduled patching rather than an emergency incident response. EPSS data was not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The most realistic threat actor is an insider or a compromised admin-level account rather than an external opportunistic attacker, given the authentication and configuration prerequisites. Organizations that do not expose the FreePBX admin interface to the public internet face substantially reduced realistic risk.

An attacker with FreePBX Music on Hold administrative access navigates to the custom application player configuration page and sets the player command to a binary such as /usr/bin/mpg123 followed by --wav /var/spool/asterisk/outgoing/attacker.call, directing mpg123 output to create an Asterisk call file in the outgoing spool directory under the asterisk service account. When FreePBX validates and applies the configuration, the player process runs with asterisk user privileges and writes the attacker-controlled file, potentially triggering unauthorized outbound calls, overwriting Asterisk configuration, or opening a named pipe for further interaction. No public POC has been identified, but the attack primitive requires only knowledge of dangerous mpg123 and compatible player flags, which are publicly documented in their respective man pages.