What is CVE-2024-58294?

CVE-2024-58294 is a high-severity vulnerability in Freepbx, classified under OS Command Injection. CVSS score: 8.8/10. Published 2025-12-11.

How severe is CVE-2024-58294?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Freepbx

CVE-2024-58294

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.032 (87.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Freepbx — versions 16
Sangoma Freepbx — versions 16.0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

ExploitDB-52031 (Exploit, exploit, Third Party Advisory, VDB Entry)
Official Product Homepage (Product, product)
Original Video Link (product, Exploit)
VulnCheck Advisory: FreePBX 16 Authenticated Remote Code Execution via API Module (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2024-58294?: CVE-2024-58294 is a high-severity vulnerability in Freepbx, classified under OS Command Injection. CVSS score: 8.8/10. Published 2025-12-11.
How severe is CVE-2024-58294?: High severity. CVSS v3 base score is 8.8 out of 10.