CVE-2026-73663 | CyberRota

CyberRota Analysis

AI-Generated

The missedcall module in FreePBX versions 16.0.0 to 16.0.11 and 17.0.4 is vulnerable to SQL injection due to improper handling of inbound Caller ID names from SIP headers, allowing unauthenticated attackers to manipulate the database and potentially gain unauthorized access to administrator accounts. Organizations using these versions of FreePBX should prioritize patching to versions 16.0.11 or 17.0.4 to mitigate the risk of exploitation. Immediate action is essential to protect sensitive data and maintain system integrity.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-73663

Severity

CRITICAL

CVSS

9.3

EPSS

0.95%

Original NVD Description

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, corrupting the database and modifying FreePBX administrator accounts to obtain unauthorized remote access. This issue is fixed in versions 16.0.11 and 17.0.4.