FreePBX Endpoint Manager CVE-2025-67513

Q: What is the CVSS score of CVE-2025-67513?

CVE-2025-67513 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

Weak Password Requirements (CWE-521)

2025-12-10 security-advisories@github.com

Information Disclosure Brute Force

6.9

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remote unauthenticated brute force of a small keyspace (AV:N/AC:L/PR:N/UI:N); impact limited to a single endpoint credential granting partial confidentiality and integrity (C:L/I:L), no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 26, 2026 - 00:01 vuln.today

DescriptionCVE.org

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.

AnalysisAI

FreePBX Endpoint Manager versions before 16.0.96 and 17.0.1 through 17.0.9 ship with a weak default app_password of only six numeric digits, which unauthenticated remote attackers can brute force to recover the credential; depending on local mapping that same password may grant access to extension, voicemail, User Manager, DPMA, or EPM phone admin functions. Severity is moderate and the impact is bounded to low confidentiality and integrity effects (CVSS v4.0 base 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N; the independent assessment confirms remote unauthenticated reach with low C/I impact and no availability impact). EPSS is 0.27% (17th percentile) and no public exploit or CISA KEV listing was identified at time of analysis. Vendor fixes are available in 16.0.96 and 17.0.10.

Technical ContextAI

The flaw is an instance of CWE-521 (Weak Password Requirements) in the FreePBX Endpoint Manager module, which provisions telephony endpoints by serving configuration that includes an app_password parameter. Rather than a randomly generated or administrator-chosen strong secret, the default is a six-digit numeric value, leaving roughly one million candidate values and a search space that is trivial for automated guessing. Because the password is consumed by the provisioning authentication surface, an attacker with network reachability to that service can iterate guesses; the independent assessment notes that practical feasibility depends on the absence of account lockout, rate limiting, or fail2ban protections in front of the service. The credential is contextual: depending on local configuration the same app_password may also serve as the extension, voicemail, User Manager, DPMA, or EPM phone admin password, so a successful guess exposes different capabilities at different sites. Deployments that already replaced the six-digit default with a strong value are not affected by the weak-default class of this issue. No CPE string was supplied with the source data, so affected scope is defined by the version ranges in the vendor advisory.

Affected ProductsAI

FreePBX Endpoint Manager releases prior to 16.0.96 on the 16.x branch, and releases 17.0.1 through 17.0.9 on the 17.x branch, are affected; 16.0.96 and 17.0.10 contain the fix. The issue was reported through the vendor security reporting process and published as GitHub advisory GHSA-426v-c5p7-cp29 (https://github.com/FreePBX/security-reporting/security/advisories/GHSA-426v-c5p7-cp29). No CPE identifiers were provided in the source data, and the concrete exposure depends on how each installation maps the app_password parameter to the extension, voicemail, User Manager, DPMA, or EPM phone admin roles.

RemediationAI

Vendor-released patch: 16.0.96 (16.x branch) and 17.0.10 (17.x branch), available per advisory GHSA-426v-c5p7-cp29 at https://github.com/FreePBX/security-reporting/security/advisories/GHSA-426v-c5p7-cp29. Upgrade to the appropriate fixed version as the primary action. If upgrade cannot be performed immediately, change the app_password from its six-digit numeric default to a long random secret on every deployment and confirm the value is not reused for the extension, voicemail, User Manager, DPMA, or EPM phone admin roles; the trade-off is that endpoints must be reprovisioned and any prior brute-force progress is only invalidated once the secret is rotated. Add rate limiting, account lockout, or fail2ban in front of the provisioning authentication surface to make online guessing impractical, accepting that aggressive thresholds can delay legitimate bulk phone provisioning or remote-worker re-registration. Restrict network reachability to the provisioning service using firewall rules, VPN, or phone-VLAN-only access, with the side effect that off-site or BYOD handsets will require VPN connectivity. Finally, monitor Endpoint Manager authentication logs for repeated app_password failures to detect brute-force attempts early.