FreePBX Endpoint Manager CVE-2025-61675

Exploitation requires an authenticated session with a known, valid FreePBX username (PR:H) and access to the Endpoint Manager module's basestation, model, firmware, or custom extension configuration functionality. There is no requirement for user interaction (UI:N) and the attack is network-reachable (AV:N) against the module's web interface. The primary limiting factor is authentication: an attacker must already possess valid credentials or compromise an existing account, so unauthenticated remote attackers cannot trigger this directly. Affected deployments are FreePBX 16 before 16.0.92 and FreePBX 17 before 17.0.6 with the Endpoint Manager module installed and in use; patched versions remove the exposure.

This is a genuine, elevated-priority issue but not a drop-everything emergency. The CVSS 4.0 base score of 8.6 (HIGH) reflects a network-reachable (AV:N), low-complexity (AC:L) SQL injection with high confidentiality and integrity impact (VC:H/VI:H) and low availability impact (VA:L), but critically requires high privileges (PR:H) - i.e., an authenticated user with a known valid username. The EPSS score of 38.45% at the 99th percentile is unusually high and signals strong predicted exploitation interest, consistent with the fact that a public exploit/POC is reported available. However, this CVE is NOT in CISA KEV, so there is no confirmed active exploitation despite the high EPSS. The most important contrast: the high EPSS and public POC must be weighed against the PR:H authentication barrier - exploitation is not possible by a fully unauthenticated attacker, which substantially lowers mass-internet-scanning risk and points toward exploitation by malicious authenticated users, compromised low-trust accounts, or chained post-authentication attacks rather than opportunistic remote takeover. No SSVC decision data was provided in the input. Net assessment: patch promptly, especially on internet-exposed FreePBX admin interfaces where credential compromise is plausible, but the authentication requirement means this is a priority tier below unauthenticated RCE.

An attacker who has obtained or been granted FreePBX admin/module credentials (a valid known username and authentication) submits crafted input to one of the vulnerable Endpoint Manager parameters in the basestation, model, firmware, or custom extension configuration areas. Because the input is concatenated into SQL queries, the attacker executes arbitrary SQL to read sensitive data (SIP secrets, user records) or modify database contents. A public exploit/POC is reported to exist, lowering the effort required to weaponize this.