CVE-2014-7235: FreePBX

High severity, CVSS 10.0. EPSS: 43.3% chance of exploitation in the next 30 days.

htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.

Affected products

• FreePBX FreePBX: version 2.10.0.0 only; version 2.10.0.1 only; version 2.10.0.2 only; version 2.10.0.3 only; version 2.10.0.4 only; version 2.10.0.5 only; …
• Sangoma FreePBX: up to and including 2.9.0.8; version 2.11.0.0 only; version 2.11.0.1 only; version 2.11.0.2 only; version 2.11.0.3 only; version 2.11.0.4 only

Published 2014-10-07. Last modified 2026-06-17.