Paper/Archive/CVE-2026-73663

CVE-2026-73663

FreePBX missedcall — FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 32.0.320 × 206.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, corrupting the database and modifying FreePBX administrator accounts to obtain unauthorized remote access. This issue is fixed in versions 16.0.11 and 17.0.4.

Affected

ProductAffectedFixed inSource

missedcall< 16.0.11–CNA

missedcall>= 17.0.1, < 17.0.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/FreePBX/security-reporting/security/advisories/GHSA-g27h-xf3q-h3rm refgithub.com/FreePBX/missedcall/commit/4ada1d6b280fc246e74babc8d52f4cd1509eff24 refgithub.com/FreePBX/missedcall/commit/710acdf51968db507b3f9c47ce3db006846cf44c