Executive Summary

This vulnerability exists in the FreePBX Endpoint Manager module, where versions prior to 16.0.96 and 17.0.1 through 17.0.9 use a weak default password. The default password is a 6-digit numeric value that can be brute forced. This password (app_password parameter) may be used for various administrative functions such as extension, voicemail, user manager, DPMA, or EPM phone admin passwords depending on local configuration. The issue is fixed in versions 16.0.96 and 17.0.10.

Useful 0 Not Useful 0

Impact Analysis

Because the default password is weak and can be brute forced, an attacker could gain unauthorized access to administrative functions of the FreePBX Endpoint Manager. This could allow them to manipulate telephony endpoints, potentially intercept calls, alter configurations, or disrupt telephony services.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreePBX Endpoint Manager to version 16.0.96 or later, or 17.0.10 or later, where the weak default password issue is fixed. Additionally, change the default 6-digit numeric app_password to a strong, complex password to prevent brute force attacks.

Useful 0 Not Useful 0