FreePBX EUVD-2026-88385

Exploitation requires an authenticated session with an existing FreePBX administrator account (PR present) and access to the Music on Hold (MoH) module's configuration endpoint that accepts the custom Asterisk application POST parameter. The target must be running FreePBX prior to 16.0.4 or 17.0.6 with the MoH module enabled and a functioning Asterisk backend that loads musiconhold_additional.conf. The primary limiting factor is the administrator-credential prerequisite - this is not exploitable pre-authentication or by low-privilege telephony users - which confines realistic risk to insider misuse, credential theft, or chaining from another auth bypass. No end-user interaction (UI:N) is needed once admin access is held.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity command injection yielding full confidentiality, integrity, and availability impact on the vulnerable system, but crucially gated behind PR:L - the description explicitly requires 'an existing FreePBX administrator account.' This is therefore a post-authentication privilege-to-code-execution flaw, not a pre-auth remote takeover, which materially lowers real-world urgency: the attacker must already hold admin credentials to the FreePBX GUI. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept identified in the provided data (only the vendor GitHub Security Advisory), so exploitation status is 'no public exploit identified at time of analysis.' The 7.7 rating is credible for what it is - reliable OS command execution as the Asterisk service - but the admin-authentication prerequisite means this is best treated as a privilege-escalation / defense-in-depth issue rather than a mass-exploitation threat. Note a mild tension worth verifying: the vendor scored PR:L, yet the requirement for an administrator (not a low-privilege user) account arguably supports PR:H; this affects prioritization only marginally since either way credentials are needed.

An attacker who has obtained or been granted a FreePBX administrator login submits a crafted POST request to the Music on Hold module setting a malicious custom Asterisk application string, which is stored unsanitized and written into musiconhold_additional.conf. When Asterisk loads that configuration and executes the specified application, the attacker's injected OS commands run with the privileges of the Asterisk service. No public exploit code is identified at time of analysis, and the attack complexity is low once admin access is held.