CVE-2026-45562 is a high severity (CVSS 7.2) OS command injection in the FreePBX Music on Hold module. An authenticated administrator can make the system run commands with the privileges of the Asterisk service. The fix is in music module versions 16.0.4 (FreePBX 16) and 17.0.6 (FreePBX 17).
What's affected
The affected component is the music module of FreePBX, the open source IP PBX from Sangoma.
- FreePBX 16: music module versions before 16.0.4. Fixed in 16.0.4.
- FreePBX 17: music module versions before 17.0.6. Fixed in 17.0.6.
An existing FreePBX administrator account is required to exploit the flaw, so this is a post-authentication issue rather than an open door from the internet.
Severity sources differ. The record scores it 7.2 (CVSS 3.1, High). The GitHub advisory scores it 7.6 (CVSS 4.0, High) and adds a threat-adjusted score of 4.9 (Medium). Both agree on High for the base score.
How to check if you're exposed
On the PBX, list module versions from the command line:
fwconsole ma list | grep -i music
Compare the version shown with the fixed versions above. You can also open Module Admin in the web interface and read the installed version there. If the module is below the fixed version for your FreePBX major release, treat the system as exposed to any account that meets the access condition in the advisory.
The advisory also tells you to look at the application column of the music database table for suspicious entries. Unexpected values there can point to earlier abuse, so review that table whether or not you have patched yet.
What to do now
- Update the
musicmodule through Module Admin orfwconsole ma upgrade musicto 16.0.4 or 17.0.6 or later. - Review the application column of the
musictable and investigate any entry you did not create. - Restrict who can reach the control panel. The advisory suggests User Management, the SysAdmin VPN, MFA or SAML, and the FreePBX Firewall module to deny hostile networks.
- Review who holds administrator accounts. The flaw needs one, so fewer and better protected accounts means less exposure.
- Note that the update limits the applications that can be set. The vendor flags this as a possibly breaking change for a small number of users who rely on removed applications.
Why it matters
The cause is CWE-78, OS command injection. The module accepted a POST parameter that defines a custom Asterisk application and stored it in the database without sanitization. Later that value was written straight into the musiconhold_additional.conf file. Asterisk reads that file and runs the application it names, so attacker-controlled text became a command.
The pattern is common in configuration-driven systems. Data that looks like a setting is written into a file that another service treats as instructions. The fix restricts which applications are allowed instead of trusting the input. The record does not mark this CVE as known exploited (it is not in CISA KEV), and the advisory does not describe exploitation in the wild.
Quick check
Does an attacker need credentials to use this flaw?
Yes. The advisory states that an existing FreePBX administrator account is required. That lowers the risk, but admin credentials are often shared or reused, so patching still matters.
What should I check after updating?
Look at the application column of the music table for entries you do not recognise. The advisory lists this as a sign of possible earlier compromise.
Sources
Last reviewed: 18 October 2026.
