Dashboard / CVE-2024-58294

CVE-2024-58294

HIGH
MEDIUM Priority: 0.31 BB Relevance: 68/100
Published: 2025-12-11 Modified: 2026-10-27 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
sangoma freepbx 16.0

References & Advisories (4)

https://www.exploit-db.com/exploits/52031
Exploit Third Party Advisory VDB Entry

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

3.57%
Raw Score 0.035680
Percentile 89.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.03568
2026-10-28
0.03568

Intelligence Sources

nvd ref →

External Links