CVE-2009-1801: Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-relea...

Security readout for executives and security teams

This is an older FreePBX web interface issue where attacker-controlled input could be reflected as script or HTML. If a vulnerable FreePBX admin interface is reachable, the main business risk is compromise of a user session or manipulation of administrator-facing pages. Exposure is most likely in organizations still running legacy FreePBX 2.4.x, 2.5.x, 2.5.1, or pre-release 2.6.x with the web interface accessible to users or the internet. Prioritize this where FreePBX remains in production or externally reachable. For modern, patched, or isolated systems, urgency is lower, but unsupported PBX admin interfaces should be removed from broad network access. Mitigation focus: Identify any FreePBX systems running the affected legacy branches.; Check FreePBX vendor guidance and ticket 3660 for the appropriate fixed version or remediation.; Restrict FreePBX administrative web access to trusted networks and authenticated administrators..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.