The FreePBX Music on Hold (MoH) module accepts a POST parameter that defines a custom Asterisk application. The module stores this input in the database without sanitization and later writes it directly to musiconhold_additional.conf. Since Asterisk reads this configuration file and executes the specified application, an attacker who can authenticate with an existing FreePBX administrator account can inject arbitrary system commands that are executed with Asterisk’s privileges. This flaw provides a direct remote code execution path from an authenticated web interface to the underlying operating system.

FreePBX installations running any version prior to 16.0.4 or 17.0.6 are affected. The vulnerability is present in the FrePBX Music on Hold module and is fixed in the specified later releases.

The flaw carries a CVSS score of 7.7, indicating moderate to high severity. Exploitation requires a valid administrator login, meaning the attacker must first compromise or have access to legitimate credentials. Once authenticated, the attacker can send a crafted POST request to the MoH module and trigger arbitrary command execution via Asterisk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, but the critical nature of RCE combined with elevated privileges makes the risk significant.