## https://sploitus.com/exploit?id=1EEC8894-D2F7-547C-827C-915BE866875C
# CVE-2025-57819-ioc-check
## Description
CVE-2024-6387-ioc-check is a lightweight, efficient tool designed to identify IoCs on freepbx servers with any of `endpoint Users should upgrade to the latest supported versions of FreePBX (currently 15, 16, and 17) and confirm that the installed "endpoint" module meets the minimum patched versions. Systems not configured for automatic updates, or those wishing to manually update, can do so via the Administrator Control Panel menu Admin -> Module Admin or via generic command line method of updating all modules:
>
> `$ fwconsole ma upgradeall`
>
> Then checking for the "endpoint" module version number:
>
> `$ fwconsole ma list | grep endpoint`
>
> Further steps, including suggestions for IOC inspection and Firewall configuration, as well as corner-case considerations, are available in the FreePBX Community Forums under the "Security Advisory: Please Lock Down Your Administrator Access" topic at https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
Source: [Authentication Bypass Leading to SQL Injection and RCE](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h)
## References
[Security Advisory: Please Lock Down Your Administrator Access](https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203)
[Authentication Bypass Leading to SQL Injection and RCE](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h)