CVE-2025-57819-ioc-check

Description

CVE-2024-6387-ioc-check is a lightweight, efficient tool designed to identify IoCs on freepbx servers with any of endpoint < 15.0.66, endpoint < 16.0.89, endpoint < 17.0.3 modules installed.

This script facilitates rapid checking of multiple IoCs to detect potential compromises and ensure your infrastructure is secure.

Usage

 curl "https://raw.githubusercontent.com/Sucuri-Labs/CVE-2025-57819-ioc-check/refs/heads/main/check.sh" -o /tmp/check.sh
 cat /tmp/check.sh
 bash /tmp/check.sh

Mitigation

Users should upgrade to the latest supported versions of FreePBX (currently 15, 16, and 17) and confirm that the installed "endpoint" module meets the minimum patched versions. Systems not configured for automatic updates, or those wishing to manually update, can do so via the Administrator Control Panel menu Admin -> Module Admin or via generic command line method of updating all modules:

$ fwconsole ma upgradeall

Then checking for the "endpoint" module version number:

$ fwconsole ma list | grep endpoint

Further steps, including suggestions for IOC inspection and Firewall configuration, as well as corner-case considerations, are available in the FreePBX Community Forums under the "Security Advisory: Please Lock Down Your Administrator Access" topic at https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203

Source: Authentication Bypass Leading to SQL Injection and RCE

References

Security Advisory: Please Lock Down Your Administrator Access

Authentication Bypass Leading to SQL Injection and RCE