CVE-2025-61678: FreePBX Endpoint Manager RCE Vulnerability

CVE-2025-61678 Overview

CVE-2025-61678 is an authenticated arbitrary file upload vulnerability in the FreePBX Endpoint Manager module. The flaw resides in the fwbrand parameter, which fails to sanitize user-supplied input and allows an attacker to control the destination file path. An authenticated attacker with a known username can chain these issues to upload a webshell to an attacker-controlled location. Successful exploitation can result in remote code execution on the FreePBX server. The vulnerability affects FreePBX 16 prior to 16.0.92 and FreePBX 17 prior to 17.0.6. The flaw is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Authenticated attackers can upload arbitrary files, including webshells, to attacker-chosen paths, enabling remote code execution on the FreePBX host.

Affected Products

• FreePBX Endpoint Manager module on FreePBX 16, versions prior to 16.0.92
• FreePBX Endpoint Manager module on FreePBX 17, versions prior to 17.0.6
• FreePBX deployments exposing the Endpoint Manager administrative interface

Discovery Timeline

• 2025-10-14 - CVE-2025-61678 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-61678

Vulnerability Analysis

The Endpoint Manager module in FreePBX manages telephony endpoint configurations and firmware. Two issues in the module combine to allow arbitrary file upload. First, the module accepts file uploads from authenticated administrative users without enforcing strict file type or extension restrictions. Second, the fwbrand parameter, which selects the firmware brand directory, is used to construct the destination file path without proper validation. An attacker who controls fwbrand can traverse or alter the upload target and write a file of arbitrary content to a web-accessible location.

Once a PHP webshell or similar executable artifact lands in a directory served by the FreePBX web server, the attacker can request the file over HTTP to trigger code execution under the web server account. This typically yields the privileges needed to interact with the Asterisk process, read configuration secrets, and pivot deeper into the telephony environment.

Root Cause

The root cause is missing validation of both the uploaded file and the path-controlling fwbrand parameter. The module trusts authenticated input to determine where firmware artifacts are written, violating standard file upload guidance that requires server-side allowlisting of extensions, content types, and fixed storage paths.

Attack Vector

Exploitation requires network access to the FreePBX administrative interface and valid credentials for a known username. The attacker submits a crafted upload request that supplies attacker-controlled file contents along with a manipulated fwbrand value. Because authentication is required, the realistic attack scenarios involve compromised administrator accounts, weak or default credentials, or malicious insiders. Refer to the FreePBX GitHub Security Advisory GHSA-7p8x-8m3m-58j9 for additional technical context.

Detection Methods for CVE-2025-61678

Indicators of Compromise

• New or unexpected .php files appearing under Endpoint Manager firmware directories or other web-accessible paths on the FreePBX host.
• HTTP POST requests to Endpoint Manager endpoints containing unusual fwbrand values, including path separators or traversal sequences.
• Web server processes spawning shells, wget, curl, or other command-line utilities shortly after an upload request.
• Outbound connections from the FreePBX server to unfamiliar hosts following administrative file upload activity.

Detection Strategies

• Monitor FreePBX web server access logs for POST requests to Endpoint Manager upload handlers with anomalous fwbrand parameters.
• Apply file integrity monitoring to the FreePBX web root and firmware directories to detect unauthorized writes.
• Alert on PHP files written outside the expected firmware storage path or with recent modification times that do not align with patch windows.
• Correlate authenticated administrative sessions with subsequent process execution chains originating from the web server user.

Monitoring Recommendations

• Forward FreePBX web server, Asterisk, and operating system logs to a centralized SIEM for correlation and retention.
• Track FreePBX administrative authentication events and flag logins from unexpected source addresses or outside business hours.
• Baseline normal Endpoint Manager upload activity and alert on deviations in file paths, sizes, or extensions.

How to Mitigate CVE-2025-61678

Immediate Actions Required

• Upgrade FreePBX 16 deployments to Endpoint Manager 16.0.92 or later and FreePBX 17 deployments to 17.0.6 or later.
• Restrict network access to the FreePBX administrative interface using firewalls or VPNs so it is not reachable from untrusted networks.
• Rotate FreePBX administrative credentials and audit accounts for unused or weakly protected logins.
• Review the FreePBX web root and firmware directories for unauthorized files and remove any webshells discovered.

Patch Information

The FreePBX maintainers have patched the issue in Endpoint Manager 16.0.92 for FreePBX 16 and 17.0.6 for FreePBX 17. Patch details are documented in the FreePBX GitHub Security Advisory GHSA-7p8x-8m3m-58j9. Administrators should apply updates through the FreePBX module admin or package manager and verify the installed version after upgrade.

Workarounds

• Where immediate patching is not possible, disable the Endpoint Manager module until the upgrade can be completed.
• Enforce multi-factor authentication and strong password policies for all FreePBX administrative accounts to reduce the likelihood of credential compromise required for exploitation.
• Place the FreePBX administrative interface behind a reverse proxy that restricts access by source IP and inspects upload parameters.

# Verify installed FreePBX Endpoint Manager module version
fwconsole ma list | grep -i endpoint

# Upgrade the Endpoint Manager module to a patched release
fwconsole ma downloadinstall endpoint
fwconsole reload