{"id":"CVE-2019-19006","kind":"vulnerability","aliases":["CVE-2019-19006"],"related":[],"title":"Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control","description":"Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Sangoma FreePBX, a web admin panel for phone systems, has an authentication flaw that can let unauthenticated users bypass the password check. An attacker who gets past login can reach services exposed by the FreePBX admin, which the sources do not detail further.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-02-03T00:00:00+00:00","products":[{"name":"Sangoma FreePBX","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sangoma freepbx","fixed":[],"affected":">= 13.0.0.0, <= 13.0.197.13","ecosystem":"vendor"},{"name":"sangoma freepbx","fixed":[],"affected":">= 14.0.0.0, <= 14.0.13.11","ecosystem":"vendor"},{"name":"sangoma freepbx","fixed":[],"affected":">= 15.0.0.0, <= 15.0.16.26","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asterisk","exploited","freepbx","infrastructure","self-hosted","voip"],"not_affected_if":["managed-hosting","not-using-freepbx"],"how_to_check":null,"fix":"Apply vendor mitigations per Sangoma guidance; the sources do not name a fixed version.\nIf no mitigation exists, discontinue use of the product per CISA guidance.","status":"open","published_at":"2019-11-21T18:15:11+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:26+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T20:42:26Z","model":"claude-haiku-5-5","output":{"fix":"Apply vendor mitigations per Sangoma guidance; the sources do not name a fixed version.\nIf no mitigation exists, discontinue use of the product per CISA guidance.","reach":"unknown","summary":"Sangoma FreePBX, a web admin panel for phone systems, has an authentication flaw that can let unauthenticated users bypass the password check. An attacker who gets past login can reach services exposed by the FreePBX admin, which the sources do not detail further.","category":"infrastructure","who_cares":["freepbx","self-hosted","voip","asterisk"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated attacker bypasses admin login and controls the phone system","analyst_note":"Find the Sangoma advisory and fixed FreePBX versions for CVE-2019-19006; the CISA KEV entry gives no versions or exposed-service detail.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","not-using-freepbx"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000452,"input_tokens":2541,"output_tokens":396,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':116C '-19006':18A,21A '-2019':17A,20A '115.0.16.26':3A '13.0.197.13':9A '14.0.13.11':6A '22':115C 'access':14A,97C 'action':106C 'admin':42B,73B,103C 'allow':89C 'appli':107C 'applic':113C 'asterisk':30B 'attack':61B 'authent':49B,85C,95C 'bod':114C 'bypass':56B,93C 'check':59B 'cisa':104C 'cloud':119C 'contain':82C 'control':15A 'cve':16A,19A 'detail':79B 'discontinu':122C 'exploit':31B 'expos':69B 'flaw':50B 'follow':112C 'freepbx':2A,23A,25A,27A,29A,32B,39B,72B,81C,102C 'get':63B 'guidanc':117C 'host':36B 'improp':84C 'incorrect':13A 'infrastructur':33B 'instruct':111C 'let':53B 'login':65B 'mitig':108C,128C 'panel':43B 'password':58B,94C 'past':64B 'per':109C 'phone':45B 'potenti':88C 'product':126C 'provid':99C 'reach':67B 'requir':105C 'sangoma':1A,22A,24A,26A,28A,38B,80C 'self':35B 'self-host':34B 'servic':68B,98C,120C 'sourc':76B 'system':46B 'unauthent':54B 'unauthor':90C 'unavail':130C 'use':123C 'user':55B,91C 'vendor':110C 'voip':37B 'vulner':86C 'web':41B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-11-21T18:15:11+00:00","kev":{"dateAdded":"2026-02-03","dueDate":"2026-02-24","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-19006","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-19006","severity":null,"published_at":"2026-02-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-19006","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19006","severity":null,"published_at":"2019-11-21T18:15:11+00:00","modified_at":"2026-06-17T15:45:04+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}