CVE-2025-67722: Sangoma FreePBX Privilege Escalation Flaw

CVE-2025-67722 Overview

CVE-2025-67722 is a local privilege escalation vulnerability in FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. The flaw resides in the deprecated amportal startup script, which searches for the freepbx_engine file in /etc/asterisk/ directories. These directories are typically writable by the asterisk user and members of the asterisk group. A local attacker with membership in the asterisk group can plant a malicious freepbx_engine file and gain root code execution when amportal runs. FreePBX framework versions prior to 16.0.45 and 17.0.24 are affected. The issue is tracked under [CWE-426: Untrusted Search Path].

Critical Impact
Members of the asterisk group can execute arbitrary code as root, achieving full system compromise of the FreePBX host.

Affected Products

Sangoma FreePBX framework versions prior to 16.0.45
Sangoma FreePBX framework versions prior to 17.0.24
Systems using the deprecated amportal startup utility

Discovery Timeline

2025-12-16 - CVE-2025-67722 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67722

Vulnerability Analysis

The vulnerability originates in the deprecated amportal utility shipped with FreePBX. When invoked, amportal performs a lookup for the freepbx_engine file inside /etc/asterisk/ directories. FreePBX configures these directories to be writable by the asterisk user and the asterisk group. Any local user in the asterisk group can therefore drop a crafted freepbx_engine script into /etc/asterisk/. When a privileged process or administrator later executes amportal, the attacker-supplied binary runs with root privileges. The result is a full privilege escalation from a low-privileged local account to root.

Root Cause

The root cause is an untrusted search path issue [CWE-426]. The amportal script trusts executable files located in a directory that is writable by non-root accounts. Because FreePBX intentionally grants write access to /etc/asterisk/ for the asterisk group, the security boundary between the asterisk group and root collapses whenever amportal is invoked with elevated privileges.

Attack Vector

Exploitation requires local access and membership in the asterisk group. The attacker writes a malicious freepbx_engine file to /etc/asterisk/ containing arbitrary shell commands. When amportal is next executed by a root-privileged context, the planted file is executed as root. No user interaction beyond normal system administration of the FreePBX server is required to trigger the payload.

No public proof-of-concept code is available. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2025-67722

Indicators of Compromise

Presence of a freepbx_engine file in /etc/asterisk/ that was not installed by the FreePBX package manager.
Unexpected files or scripts in /etc/asterisk/ owned by members of the asterisk group rather than by root.
Root-owned processes spawned as children of amportal executing shell payloads or writing to sensitive system paths.

Detection Strategies

Audit /etc/asterisk/ for files matching freepbx_engine and verify ownership, modification time, and package provenance.
Enumerate members of the asterisk group and correlate with expected administrative users; flag any unauthorized additions.
Monitor invocations of the deprecated amportal utility and log the full path of any freepbx_engine binary it executes.

Monitoring Recommendations

Enable filesystem integrity monitoring on /etc/asterisk/ and alert on new or modified executable files.
Log and review Asterisk dial plan applications such as System() and FILE() for unsafe custom use that can manipulate the filesystem.
Confirm that live_dangerously = no is set (or left unconfigured, since the default is no) in /etc/asterisk/asterisk.conf and alert on changes.

How to Mitigate CVE-2025-67722

Immediate Actions Required

Upgrade the FreePBX framework to version 16.0.45, 17.0.24, or later.
Review and restrict membership of the asterisk group to trusted local operating system users only.
Inspect /etc/asterisk/ for suspicious files using the Admin -> Config Edit GUI or via CLI, and remove any unauthorized freepbx_engine file.

Patch Information

Sangoma has released fixed versions of the FreePBX framework in 16.0.45 and 17.0.24. Administrators should apply these updates through the standard FreePBX module admin or package management workflow. Refer to the GitHub Security Advisory GHSA-p42w-v77m-hfp8 and the FreePBX Security Updates Overview for release notes and downloads.

Workarounds

Avoid using the deprecated amportal startup script; use supported service management tools to start and stop Asterisk.
Verify live_dangerously = no is set in /etc/asterisk/asterisk.conf to prevent unsafe dial plan functions from executing.
Eliminate custom dial plan applications and functions that can manipulate the filesystem, including System() and FILE() usage that is not strictly required.
Tighten filesystem permissions on /etc/asterisk/ so that only trusted service accounts retain write access.

bash

# Configuration example
# Verify asterisk group membership
getent group asterisk

# Search for unauthorized freepbx_engine files
find /etc/asterisk/ -name 'freepbx_engine' -exec ls -la {} \;

# Confirm live_dangerously is disabled in asterisk.conf
grep -i 'live_dangerously' /etc/asterisk/asterisk.conf