FreePBX Endpoint Manager CVE-2025-61678

Exploitation requires an authenticated session to the FreePBX web administration interface with access to the Endpoint Manager module and a known/valid username; the core technique abuses the 'fwbrand' parameter in the module's firmware/file-upload function to override the destination file path, allowing an arbitrary file (e.g. a PHP webshell) to be written to an attacker-chosen, web-accessible location. The primary limiting factor is the authentication requirement - this is not an unauthenticated flaw - so real-world risk concentrates on deployments with internet-exposed admin GUIs, weak/default/reused credentials, or broadly granted module permissions. Affected builds are FreePBX 16 before 16.0.92 and FreePBX 17 before 17.0.6; patched versions remediate the path-traversal behavior.

This is a genuine priority, not a paper-high score. The signals align strongly: CVSS 4.0 base 8.6 (High) with AV:N/AC:L/UI:N indicates trivial network-reachable exploitation requiring no victim interaction, and an exceptionally high EPSS of 43.68% (99th percentile) marks it as among the most likely-to-be-exploited CVEs, consistent with the publicly available exploit code. The one mitigating signal is PR:H in the vendor vector (authentication with a known username required), which gates exploitation behind valid credentials - meaning this is most dangerous where credentials are weak, reused, default, or the admin GUI is internet-exposed. There is a minor internal tension worth verifying: the description characterizes the actor as 'authenticated users' and notes only that a 'known username' is required, which reads closer to low-privilege (PR:L) than the vendor's PR:H; teams should confirm the exact privilege level needed to reach the Endpoint Manager module. It is NOT currently on CISA KEV, so despite the high EPSS and public POC there is no confirmed in-the-wild exploitation at time of analysis - the high EPSS reflects predicted/likely exploitation given a public exploit, which should not be conflated with active attacks.

An attacker who holds valid FreePBX admin-GUI credentials (or obtains them via weak/default/reused passwords on an exposed interface) sends a crafted file-upload request to the Endpoint Manager module, abusing the fwbrand parameter to redirect the upload path and plant a PHP webshell in a web-accessible directory. They then browse to the uploaded webshell to execute arbitrary commands as the web server user, achieving remote code execution. Public exploit code for this flaw is already available, lowering the skill barrier considerably.