A cross‑site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The Ajax dispatcher in the admin panel does not validate a CSRF token, letting the attacker craft privileged requests that execute without the administrator’s consent. This flaw can lead to unauthorized configuration changes, potentially compromising call routing, security settings, and system availability.

Products affected are FreePBX Framework version 17.0. The vulnerability exists in the amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php file that handles Ajax requests in the admin panel.

The vulnerability carries a CVSS score of 8.8, indicating a high severity level. No EPSS score is available and it is not listed in the CISA KEV catalog. The attack vector is a CSRF scenario where the attacker lures a legitimate administrator to a malicious web page, enabling the attacker to send a request to /admin/ajax.php while the administrator is authenticated. This allows the attacker to invoke any admin function tied to the Ajax dispatcher.