FreePBX CVE-2025-67722

Exploitation requires a local account that is a member of the asterisk group (granting write access to /etc/asterisk/ directories), the presence of the deprecated amportal startup script, and that script subsequently being executed with root privileges. Key limiting factors: the attacker must already be a trusted-group local user (not remote, not an arbitrary unprivileged account), FreePBX must be older than 16.0.45 / 17.0.24, and the legacy amportal utility must still be in use. Risk is effectively neutralized where only trusted OS users belong to the asterisk group and where live_dangerously = no (the default) is set in /etc/asterisk/asterisk.conf.

This is a genuine but comparatively low-urgency issue - a local privilege-escalation flaw (CWE-426, untrusted search path) in the deprecated amportal startup script, not a remotely exploitable one. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, base 5.7) confirms a local attack vector with no user interaction but requiring existing privileges, and all three impact metrics are High (VC:H/VI:H/VA:H) because successful exploitation yields root. Exploitation signals are weak: EPSS is only 0.13% (2nd percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis - so there is no public exploit identified at time of analysis. The low EPSS is consistent with a local-only, precondition-heavy flaw rather than a mass-exploited internet-facing bug. One tension worth noting: the vendor rates PR:H, but the described precondition is membership in the asterisk service group, which is a specific granted privilege rather than full administrative access - this reviewer assesses it closer to PR:L, which would raise the real-world severity for any environment where non-trusted accounts belong to that group. Net: treat as a standard patch-cycle item for FreePBX operators, elevated only where untrusted users share the asterisk group.

A local user who is a member of the asterisk group plants a malicious freepbx_engine file in a writable /etc/asterisk/ directory. When an administrator or scheduled process later runs the deprecated amportal script, it locates and executes that attacker-controlled file with root privileges, giving the low-privileged user full root on the host. No public exploit was identified at time of analysis, and exploitation is local-only with no user interaction required of the victim beyond running amportal.