CVE-2019-19006
Summary
| CVE | CVE-2019-19006 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-11-21 18:15:00 UTC |
| Updated | 2020-08-24 17:37:00 UTC |
| Description | Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. |
Risk And Classification
EPSS: 0.216360000 probability, percentile 0.956950000 (date 2026-04-01)
CISA KEV: Listed on 2026-02-03; due 2026-02-24; ransomware use Unknown
Problem Types: CWE-287
CISA Known Exploited Vulnerability
| Vendor | Sangoma |
|---|---|
| Product | FreePBX |
| Name | Sangoma FreePBX Improper Authentication Vulnerability |
| Required Action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| Notes | https://wiki.freepbx.org/display/FOP/2019-11-20%2BRemote%2BAdmin%2BAuthentication%2BBypass ; https://nvd.nist.gov/vuln/detail/CVE-2019-19006 |
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| FreePBX Security Vulnerability SEC-2019-001 - Security - FreePBX Community Forums | MISC | community.freepbx.org | Vendor Advisory |
| 2019-11-20 Remote Admin Authentication Bypass - FreePBX OpenSource Project - Documentation | CONFIRM | wiki.freepbx.org | Vendor Advisory |
| FreePBX News | FreePBX | MISC | www.freepbx.org | Product |
| Pastebin.com - Not Found (#404) | MISC | pastebin.com | Broken Link |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 730044 FreePBX Incorrect Access Control Vulnerability (SEC-2019-001)