FreePBX CVE-2025-67736

Requires an authenticated session with administrator-level access to the FreePBX Administrator Control Panel (ACP) and the presence/use of the Text-to-Speech (tts) module on a vulnerable install (FreePBX versions prior to 16.0.5 or 17.0.5). The injection point is reached through tts module functionality. Limiting factors: the PR:H administrator prerequisite sharply narrows the attacker population to those already holding admin credentials (insiders, phished/reused credentials, or an attacker who already escalated into ACP); no user interaction is needed (UI:N) and the vector is network-reachable (AV:N) to the admin interface. The described privilege escalation to root is a chained post-exploitation outcome, not a separate precondition.

This is a genuine but access-gated risk rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, base 8.6) is driven high by full confidentiality/integrity/availability impact and the description's claim of chained elevation from the asterisk user to root - but the single most important mitigating signal is PR:H: exploitation requires an attacker who already holds administrator access to the Administrator Control Panel. That makes this primarily a privilege-escalation / post-compromise RCE vector or an insider/credential-theft concern, not an unauthenticated internet-facing break-in. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code - the signals are internally consistent (high-impact but high-privilege) and do not conflict. Net: a real priority for environments where ACP admin credentials could be phished, reused, or over-shared, but not a drop-everything internet-wide emergency given the administrator-access prerequisite.

An attacker who has obtained FreePBX Administrator Control Panel credentials (via phishing, credential reuse, or a lower-privilege foothold) submits crafted input through the Text-to-Speech (tts) module, injecting SQL to read sensitive database contents. They then leverage the injection to execute code as the asterisk OS user and chain known local techniques to escalate to root. No public exploit code was identified in the provided data.