CVE-2019-19006 — VulnIntel

CVE-2019-19006

CRITICAL

KEV

Exploit

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

설명

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Score Summary

CVSS Score: 9.8
Version: 3.1
VPI: 100
Why this VPI (explainable, experimental)
VPI breakdown
Impact 98.00
Exploitation signal(KEV listed) ×1.50
VPI 100.00
VPI formula vpi-v1
EPSS: 36.6%
(상위 98.3%)
Attack Vector: Network
Low Complexity
No Privileges
No User Interaction
Scope Unchanged
High Confidentiality Impact
High Integrity Impact
High Availability Impact

Details

Published: 11/21/2019(7 years ago)
Modified: 06/17/2026(last month)
Source: KEV, NVD
Products: 1

CISA KEV Listing

Vendor / Project: Sangoma
Product: FreePBX

Date Added: 02/03/2026
Due Date: 02/24/2026Overdue 148d

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability Lifecycle

NVDPublished11/21/2019
CISA KEVKEV Listed02/03/2026
CISA KEV

Score Comparison by Source

Source	CVSS Version	Base Score	Severity	Vector String	Assessment Date
NVDNIST	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	04/20/2026
NVDNIST	2.0	7.5

CWE Weakness Classification

CWE-287
NVD
Secondary

References (6)

NVD
https://pastebin.com/2CdsQMKW
NVD
Advisory
https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+Bypass
NVD

Affected Products (1)

Impact	98.00
Exploitation signal(KEV listed)	×1.50
VPI	100.00