CVE-2025-67513: FreePBX Endpoint Manager Auth Bypass Flaw

CVE-2025-67513 Overview

CVE-2025-67513 affects the FreePBX Endpoint Manager module, which manages telephony endpoints in FreePBX systems. The module ships with a weak default password consisting of a 6-digit numeric value stored in the app_password parameter. Attackers can brute force this value across the network to gain access. Depending on local configuration, the compromised credential may serve as the extension, voicemail, User Manager, DPMA, or EPM phone admin password. The issue affects versions prior to 16.0.96 and versions 17.0.1 through 17.0.9. Maintainers resolved the flaw in versions 16.0.96 and 17.0.10. The weakness is tracked as [CWE-521: Weak Password Requirements].

Critical Impact
Successful brute force of the 6-digit app_password grants unauthorized access to voicemail, extension, or phone administration functions on affected FreePBX deployments.

Affected Products

FreePBX Endpoint Manager versions prior to 16.0.96
FreePBX Endpoint Manager versions 17.0.1 through 17.0.9
FreePBX systems using the app_password parameter as the extension, voicemail, User Manager, DPMA, or EPM phone admin password

Discovery Timeline

2025-12-10 - CVE-2025-67513 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67513

Vulnerability Analysis

The FreePBX Endpoint Manager assigns each endpoint an app_password value that authenticates administrative and user actions on the phone. By default, this password is generated as a 6-digit numeric string. The resulting keyspace contains only one million possible values, which an attacker can enumerate in a short time using automated tooling against exposed FreePBX interfaces. Because FreePBX deployments frequently expose signaling and provisioning endpoints to internal or external networks, the network attack vector is realistic. Depending on how the administrator configured the system, the same value may authenticate voicemail retrieval, User Manager login, Digium Phone Module for Asterisk (DPMA) sessions, or EPM phone administration. A successful brute force therefore compromises telephony features and, in some deployments, administrative access to the endpoint configuration.

Root Cause

The root cause is a weak password policy for automatically generated credentials. The default generator produced only numeric values with a fixed length of six digits, which fails to meet modern entropy requirements. This maps directly to [CWE-521: Weak Password Requirements].

Attack Vector

An unauthenticated remote attacker enumerates the 6-digit app_password against a FreePBX authentication surface bound to the affected endpoint. No user interaction is required. Once the correct value is guessed, the attacker authenticates as the associated extension, voicemail user, or administrative role. See the FreePBX GitHub Security Advisory for technical details.

// No verified proof-of-concept code is available for CVE-2025-67513.
// The exploitation pattern is a straightforward credential brute force
// against the 6-digit numeric app_password across authentication surfaces
// that consume this value (voicemail, User Manager, DPMA, or EPM admin).

Detection Methods for CVE-2025-67513

Indicators of Compromise

High volumes of authentication attempts against voicemail, User Manager, DPMA, or EPM phone admin endpoints from a single source
Sequential or dictionary-style guesses of 6-digit numeric passwords in FreePBX authentication logs
Successful logins immediately following rapid failed attempts on the same account
Unexpected changes to endpoint provisioning, call forwarding rules, or voicemail greetings

Detection Strategies

Alert on repeated failed authentication events per account within short time windows in FreePBX and Asterisk logs
Correlate failed and successful authentication events by source IP to surface brute force followed by account takeover
Baseline normal login volumes for administrative modules and flag deviations

Monitoring Recommendations

Forward FreePBX, Asterisk, and web front-end logs to a central SIEM for retention and correlation
Monitor outbound call detail records for anomalous destinations or toll-fraud patterns after a suspected compromise
Track configuration changes to the Endpoint Manager and User Manager modules

How to Mitigate CVE-2025-67513

Immediate Actions Required

Upgrade FreePBX Endpoint Manager to version 16.0.96 or 17.0.10 as documented in the FreePBX GitHub Security Advisory
Rotate the app_password value for every existing endpoint after upgrading, since existing weak passwords persist across the update
Restrict network access to FreePBX administrative and provisioning interfaces to trusted management networks
Review authentication logs for prior brute force activity against voicemail, User Manager, DPMA, or EPM admin surfaces

Patch Information

The FreePBX maintainers fixed the weak default password generator in Endpoint Manager versions 16.0.96 and 17.0.10. Administrators running any 17.0.x release between 17.0.1 and 17.0.9, or any 16.x release prior to 16.0.96, must upgrade. Patching alone does not remediate credentials that were already generated; operators must reset the affected passwords.

Workarounds

Manually replace 6-digit numeric app_password values with longer alphanumeric passwords where the Endpoint Manager supports it
Place FreePBX authentication endpoints behind a VPN or firewall rule that limits source addresses
Enable rate limiting or fail2ban rules on Asterisk and FreePBX authentication endpoints to slow brute force attempts

bash

# Example: fail2ban filter tuning for repeated FreePBX authentication failures
# /etc/fail2ban/jail.d/freepbx.local
[freepbx-auth]
enabled  = true
port     = http,https,5060,5061
filter   = freepbx-auth
logpath  = /var/log/asterisk/full
           /var/log/httpd/access_log
maxretry = 5
findtime = 300
bantime  = 3600