CVE-2025-67513
BaseFortify
Publication date: 2025-12-10
Last updated on: 2025-12-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freepbx | endpoint_manager | 17.0.9 |
| freepbx | endpoint_manager | 17.0.1 |
| freepbx | endpoint_manager | 17.0.10 |
| freepbx | endpoint_manager | 17.0.6 |
| freepbx | endpoint_manager | 17.0.5 |
| freepbx | endpoint_manager | 17.0.2 |
| freepbx | endpoint_manager | 17.0.3 |
| freepbx | endpoint_manager | 17.0.8 |
| freepbx | endpoint_manager | 16.0.96 |
| freepbx | endpoint_manager | 17.0.7 |
| freepbx | endpoint_manager | 17.0.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-521 | The product does not require that users should have strong passwords. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the FreePBX Endpoint Manager module, where versions prior to 16.0.96 and 17.0.1 through 17.0.9 use a weak default password. The default password is a 6-digit numeric value that can be brute forced. This password (app_password parameter) may be used for various administrative functions such as extension, voicemail, user manager, DPMA, or EPM phone admin passwords depending on local configuration. The issue is fixed in versions 16.0.96 and 17.0.10.
How can this vulnerability impact me? :
Because the default password is weak and can be brute forced, an attacker could gain unauthorized access to administrative functions of the FreePBX Endpoint Manager. This could allow them to manipulate telephony endpoints, potentially intercept calls, alter configurations, or disrupt telephony services.
What immediate steps should I take to mitigate this vulnerability?
Upgrade FreePBX Endpoint Manager to version 16.0.96 or later, or 17.0.10 or later, where the weak default password issue is fixed. Additionally, change the default 6-digit numeric app_password to a strong, complex password to prevent brute force attacks.