External risk intelligence

FreePBX Missed Call Module SQL Injection Leading to Administrator Account Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73663

FreePBX is an IP-PBX system designed to handle telephony traffic directly. As it processes SIP traffic—which is frequently exposed to the internet to allow remote endpoints and trunks to connect—this service is public-facing by design in typical VoIP deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in FreePBX's missedcall module allows attackers to inject SQL queries through crafted SIP headers, potentially corrupting the database and enabling unauthorized remote access by modifying administrator accounts. The primary concern is to confirm if FreePBX is in use and if the affected module is active.

Unauthenticated callers can alter administrator accounts.
Critical access flaw could impact internal communication systems.
Confirm FreePBX relevance and exposure to this vulnerability.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can initiate a phone call to a monitored extension. If the call is unanswered, the system processes the caller's information from a crafted SIP header, leading to an SQL injection. This can corrupt the system's database, allowing the attacker to alter administrator accounts and gain unauthorized remote access.

No prior access required.
Unanswered calls trigger vulnerability.
Unauthorized remote access risk.

Live Threat

Current exploitation, exposure, and threat context

A crafted SIP header could allow an unauthenticated attacker to corrupt the FreePBX database when a monitored extension is not answered. This could lead to unauthorized remote access by modifying administrator accounts.

Database integrity and administrator accounts.
Answering an unanswered, monitored extension.
Unauthorized remote access to FreePBX.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in FreePBX's missedcall module allows unauthenticated attackers to corrupt the database and gain unauthorized remote access by injecting SQL into the missedcalllog. The first practical step is to identify all FreePBX instances, determine their exposure and business criticality, locate the accountable system owner, and then plan remediation.

FreePBX application or infrastructure owners.
Verify FreePBX instance reachability and criticality.
Plan and coordinate remediation with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreePBX?

FreePBX is an open-source IP-based PBX system used to manage business telephony, routing calls over internet protocols. It acts as a central switchboard for voice services. The software relies on modular components, such as the missedcall module, to extend its functionality, including logging call activity and managing missed call notifications for users.

What does CVE-2026-73663 mean by SQL injection?

This vulnerability falls under the CWE-89 weakness class, which happens when software fails to safely sanitize user-provided data before using it in a database query. In this case, the missedcall module incorrectly handles information from SIP headers. By embedding malicious database commands within these headers, an attacker can trick the system into executing unauthorized actions, such as modifying administrator account details.

How is this SQL injection triggered?

An attacker initiates a call to a monitored extension and leaves it unanswered. Because the system automatically logs this event using the incoming caller's information from the SIP header, it processes the malicious input. Note that this attack does not require any pre-existing authentication, but it only proceeds if the call remains unanswered and is processed by the vulnerable module.

Is my FreePBX instance at risk?

Halo Surface Signal indicates that FreePBX is very likely to be public-facing because it must process external SIP traffic to function with remote phones and trunks. If your instance is reachable via the internet, it is exposed to these inbound calls. You should prioritize assessing instances that handle public telephony traffic, as these are the most direct pathways for an unauthenticated attacker to reach the vulnerable module.

How do I respond to this vulnerability?

First, identify all active FreePBX installations and determine if they are running the affected versions. Since this is a critical flaw, coordinate with your system administrators to update the software to the patched versions. Verifying which systems are internet-exposed and ensuring the missedcall module is reviewed or disabled if patching is delayed can help manage the risk while you plan your official software update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.