CVE-2019-19006

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772Vendor Advisory
https://pastebin.com/2CdsQMKWBroken Link
https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+BypassVendor Advisory
https://www.freepbx.org/category/blog/Product
https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772Vendor Advisory
https://pastebin.com/2CdsQMKWBroken Link
https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+BypassVendor Advisory
https://www.freepbx.org/category/blog/Product
https://research.checkpoint.com/2020/inj3ctor3-operation-leveraging-asterisk-servers-for-monetization/Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19006US Government Resource

Timeline

Published: Nov 21, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 3, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-190077.2Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled, a rela CVE-2019-19018.8A vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mo CVE-2019-190109.8Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to d CVE-2019-190117.5MiniUPnP ngiflib 0.4 has a NULL pointer dereference in GifIndexToTrueColor in ngiflib.c via a file that lacks a palette.CVE-2019-190129.8An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which CVE-2019-190138.8A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.CVE-2019-190147.8An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of CVE-2019-190159.8An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) allows connections to t CVE-2019-190167.5An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration interface are vulnera CVE-2019-190178.1An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker c CVE-2019-190182.7An issue was discovered in TitanHQ WebTitan before 5.18. It exposes a database configuration file under /include/dbconfig.ini in the web adm CVE-2019-190197.5An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an attacker can execute arb