PT-2025-51351 · Asterisk+1 · Asterisk+1

Thattotallyrealmyth · Published 2025-12-16 · Updated 2025-12-21 · CVE-2025-67722

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.45 FreePBX versions prior to 17.0.24

Description FreePBX is a web-based graphical user interface for managing Asterisk. A local privilege escalation exists in the deprecated FreePBX startup script amportal in versions prior to 16.0.45 and 17.0.24. The amportal utility searches for the freepbx engine file in /etc/asterisk/ directories, which are typically writable by the asterisk user and members of the asterisk group. An attacker who is a member of the asterisk group can place a malicious freepbx engine file in /etc/asterisk/, which will then be executed with root privileges when amportal runs. The System() and FILE() functions are examples of Asterisk dial plan applications and functions that can potentially manipulate the file system.

Recommendations FreePBX versions prior to 16.0.45 should be updated to version 16.0.45 or later. FreePBX versions prior to 17.0.24 should be updated to version 17.0.24 or later. Confirm only trusted local OS system users are members of the asterisk group. Look for suspicious files in the /etc/asterisk/ directory via the Admin -> Config Edit interface in the GUI, or via the command line interface. Double-check that live dangerously = no is set (or unconfigured, as the default is 'no') in the /etc/asterisk/asterisk.conf file. Eliminate any unsafe custom use of Asterisk dial plan applications and functions that potentially can manipulate the file system, such as System() and FILE().

Exploit

Fix

LPE

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2025-67722

GHSA-P42W-V77M-HFP8

Affected Products

Asterisk

Freepbx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67722.json · Exploit
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p42w-v77m-hfp8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67722 · Vendor Advisory
• https://freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67722 · Security Note
• https://t.me/cveNotify/145887 · Telegram Post
• https://t.me/CVEtracker/39899 · Telegram Post
• https://twitter.com/CVEnew/status/2002836008186810819 · Twitter Post