PHP Fatal error: Uncaught Error: Class "Symfony\Component\Console\Application" not found in /var/www/html/admin/libraries/FWApplication.class.php:11 Stack trace: #0 /var/lib/asterisk/bin/fwconsole(66): include() #1 {main} thrown in /var/www/html/admin/

[Pandamien]

We have IPs Whitelist setup however, it seems that this specific instance had the Web access on Internet still active.

[jfinstrom (James Finstrom)]

@penguinpbx When should we expect the CVE for this?

[SamShomi (sshomi)]

Does endpoint manager need to be enabled or can it still be exploited if it is installed and disabled?

[penguinpbx (C. Maj)]

@SamShomi

can it still be exploited if it is installed

Yes. Please review last week’s updates to the forum post Security Advisory: Please Lock Down Your Administrator Access for more information on CVE-2025-57819.

@SamShomi

and disabled

EDIT: Probably, but will review test cases - even if Disabled, the code is usually sitting there on your system, under /var/www/html/

[SamShomi (sshomi)]

@penguinpbx

@SamShomi

can it still be exploited if it is installed

Yes. Please review last week’s updates to the forum post Security Advisory: Please Lock Down Your Administrator Access for more information on CVE-2025-57819.

@SamShomi

and disabled

EDIT: Probably, but will review test cases - even if Disabled, the code is usually sitting there on your system, under /var/www/html/

Seems like a rather large attack surface of that’s true. I guess all the stuff in .htaccess, only allowing access to certain files, doesn’t help much. Not sure what can be done about it. Maybe not putting the module files in the publicly accessible web folder? The CVE doesn’t go into enough detail for me to know what this specific attack vector was beyond the initial input sanitization problem.