CVE-2012-4869: FreePBX callme_page.php callmenum parameter command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote command execution with public exploit code and very high EPSS probability, though not in CISA KEV and affecting an older FreePBX release.

What it is

FreePBX 2.9, 2.10 and earlier contains a code injection flaw in the callme_startcall function in recordings/misc/callme_page.php. The callmenum parameter supplied in a c action is not properly sanitized, allowing arbitrary command execution on the server. Because FreePBX is a PBX management platform, compromise can expose call handling and connected telephony infrastructure.

Impact

A remote attacker can execute arbitrary commands on the FreePBX host, gaining the privileges of the web server process and potentially pivoting into the telephony environment. This can lead to full system compromise and interception or manipulation of voice services.

Attack surface

The flaw is reachable over the network through the callme_page.php endpoint using a crafted c action and callmenum parameter. The CVSS vector AV:N/AC:L/Au:N indicates no authentication is required and no user interaction is needed.

Exploitation

Public exploit code exists in Exploit-DB and SecurityFocus references, and EPSS shows a high 30-day probability (0.70, 99th percentile), though the CVE is not listed in CISA KEV. No ransomware association is documented.

What to do

• Upgrade FreePBX to a version later than 2.10 that fixes the callme_page.php command injection.
• If immediate upgrade is not possible, restrict network access to the recordings/misc/callme_page.php endpoint and the FreePBX administrative interface.
• Apply vendor guidance from the FreePBX ticket 5711 and Secunia advisory 48463.
• Run the FreePBX web service with least privilege and isolate it from sensitive internal networks.
• Monitor and block requests containing shell metacharacters in the callmenum parameter at the web application firewall.

Detection

• Inspect web server logs for requests to recordings/misc/callme_page.php with a c action and suspicious callmenum values containing shell metacharacters.
• Alert on outbound network connections or process creation from the FreePBX web server user that are unexpected.
• Search for known exploit payload patterns from Exploit-DB 18649 and 18659 in HTTP request logs.
• Monitor for unusual child processes spawned by the web server (for example shell, wget, curl, nc).

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.