CVE-2025-67722
CVE-2025-67722 is a high-severity vulnerability in Sangoma Freepbx with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-426.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- CVSS v4: 5.7
- EPSS exploit prediction: 0% (2nd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-203482
- Weakness: CWE-426
- Affected product: Sangoma Freepbx
- Published:
- Last modified:
Description
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group. This means that a member of the **asterisk** group can add their own `freepbx_engine` file in `/etc/asterisk/` and upon `amportal` executing, it would exec that file with root permissions (even though the file was created and placed by a non-root user). Version 16.0.45 and 17.0.24 contain a fix for the issue. Other mitigation strategies are also available. Confirm only trusted local OS system users are members of the `asterisk` group. Look for suspicious files in the `/etc/asterisk/` directory (via Admin -> Config Edit in the GUI, or via CLI). Double-check that `live_dangerously = no` is set (or unconfigured, as the default is **no**) in `/etc/asterisk/asterisk.conf` file. Eliminate any unsafe custom use of Asterisk dial plan applications and functions that potentially can manipulate the file system, e.g., System(), FILE(), etc.
Frequently asked questions
- What is CVE-2025-67722?
- FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group. This means that a member of the **asterisk** group can add their own `freepbx_engine` file in `/etc/asterisk/` and upon `amportal` executing, it would exec that file with root permissions (even though the file was created and placed by a non-root user). Version 16.0.45 and 17.0.24 contain a fix for the issue. Other mitigation strategies are also available. Confirm only trusted local OS system users are members of the `asterisk` group. Look for suspicious files in the `/etc/asterisk/` directory (via Admin -> Config Edit in the GUI, or via CLI). Double-check that `live_dangerously = no` is set (or unconfigured, as the default is **no**) in `/etc/asterisk/asterisk.conf` file. Eliminate any unsafe custom use of Asterisk dial plan applications and functions that potentially can manipulate the file system, e.g., System(), FILE(), etc.
- How severe is CVE-2025-67722?
- CVE-2025-67722 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2025-67722 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-67722?
- CVE-2025-67722 affects Sangoma Freepbx. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-67722?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2025-67722 have an EU (EUVD) identifier?
- Yes. CVE-2025-67722 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-203482.
- When was CVE-2025-67722 published?
- CVE-2025-67722 was published on 2025-12-16 and last updated on 2026-06-17.
References
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p42w-v77m-hfp8
- https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80
Affected products (1)
- cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*
More vulnerabilities in Sangoma Freepbx
- CVE-2014-7235 — Critical (CVSS 10.0): htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9,…
- CVE-2026-46376 — Critical (CVSS 9.8): FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to…
- CVE-2025-66039 — Critical (CVSS 9.8): FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to…
- CVE-2025-57819 — Critical (CVSS 9.8): FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to…
- CVE-2019-19006 — Critical (CVSS 9.8): Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
- CVE-2026-44239 — High (CVSS 8.8): FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes…
All CVEs affecting Sangoma Freepbx →
Other CWE-426 (Untrusted Search Path) vulnerabilities
- CVE-2026-45772 — Critical (CVSS 9.8): Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14,…
- CVE-2025-26155 — Critical (CVSS 9.8): NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path…
- CVE-2024-53866 — Critical (CVSS 9.8): The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one…
- CVE-2024-38462 — Critical (CVSS 9.8): iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the…
- CVE-2023-30330 — Critical (CVSS 9.8): SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function…
- CVE-2022-24826 — Critical (CVSS 9.8): On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and…
Browse all CWE-426 (Untrusted Search Path) vulnerabilities →