FreePBX’s Backup module exposes an authenticated AJAX endpoint that accepts an administrator’s SSH public key and appends it to the system user asterisk’s authorized_keys file. The key grants the attacker persistent shell access with the privileges of the asterisk user, enabling execution of arbitrary commands, viewing or modifying FreePBX configuration and call data, changing system files, and potentially disrupting services.

The vulnerability exists in the FreePBX Backup module between version 17.0.5.34 and 17.0.11. Any installation within that range and possessing an authenticated administrator account is susceptible.

With a CVSS score of 8.6 the vulnerability is considered high severity, and the EPSS score is not available, indicating no publicly available quantified probability. It is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to be authenticated as an administrator; from there the endpoint can be invoked to inject an SSH key, which the asterisk user can use to maintain shell access. The lack of backup‑only command and source restrictions makes the exploitation straightforward for an internal attacker or one who gains administrative credentials.