CVE-2019-19006
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
Affects 1 product across 1 vendor.
Software does not prove or insufficiently proves that the user is who they claim to be.
Show all 10
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
The CVE-2019-19006 affects Sangoma FreePBX versions 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below, leading to Incorrect Access Control. This vulnerability has a CVSS score of 9.8, indicating a critical severity level. The issue allows unauthorized access to the system, which can lead to data breaches and system compromise. Immediate action is required to mitigate the risk.
BSID: BS-2019-GLOBAL-277852-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2019-19006?
What is the CVSS score for CVE-2019-19006?
Is CVE-2019-19006 actively exploited?
How do I remediate CVE-2019-19006?
What systems are affected by CVE-2019-19006?
What NERC-CIP standard applies to CVE-2019-19006?
What IEC 62443 requirement maps to CVE-2019-19006?
| CVE ID | CVE-2019-19006 |
|---|---|
| BSID | BS-2019-GLOBAL-277852-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2019-11-21 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from incorrect access control in the affected versions of Sangoma FreePBX. An attacker can exploit this issue to gain unauthorized access to the system without requiring any user interaction. The attack can be performed remotely over the network, making it highly accessible to potential attackers.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Sangoma | Freepbx | ≥ 13.0.0.0, ≤ 13.0.197.13 ≥ 14.0.0.0, ≤ 14.0.13.11 ≥ 15.0.0.0, ≤ 15.0.16.26 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | ● Active Exploitation Confirmed (added 2026-02-03) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict access controls and authentication mechanisms to restrict unauthorized access to the FreePBX system. Regularly audit access logs to detect and respond to suspicious activities.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 by allowing unauthorized access to the system, which can compromise the security of the control center and potentially affect the reliability of the bulk electric system.
This CVE maps to SR 7.6 as it involves a failure in access control, which is essential for maintaining the security of industrial control systems and preventing unauthorized access to critical functions.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 86c969ce42557cd4975f34842d493114761958b67d0b5cca503507560f27127aa3612be9f17b3924bf2027b3ea12f4377f94d228ce03309596cdac794cc6ba2e |
This Vulnerability Is Being Actively Exploited
CVE-2019-19006 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →