BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-10

Assigner: GitHub, Inc.

Description

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-10

Last Modified

2025-12-10

Generated

2026-07-06

AI Q&A

2025-12-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-67513

Affected Vendors & Products

Vendor	Product	Version / Range
freepbx	endpoint_manager	17.0.9
freepbx	endpoint_manager	17.0.1
freepbx	endpoint_manager	17.0.10
freepbx	endpoint_manager	17.0.6
freepbx	endpoint_manager	17.0.5
freepbx	endpoint_manager	17.0.2
freepbx	endpoint_manager	17.0.3
freepbx	endpoint_manager	17.0.8
freepbx	endpoint_manager	16.0.96
freepbx	endpoint_manager	17.0.7
freepbx	endpoint_manager	17.0.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-521	The product does not require that users should have strong passwords.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the FreePBX Endpoint Manager module, where versions prior to 16.0.96 and 17.0.1 through 17.0.9 use a weak default password. The default password is a 6-digit numeric value that can be brute forced. This password (app_password parameter) may be used for various administrative functions such as extension, voicemail, user manager, DPMA, or EPM phone admin passwords depending on local configuration. The issue is fixed in versions 16.0.96 and 17.0.10.

Impact Analysis

Because the default password is weak and can be brute forced, an attacker could gain unauthorized access to administrative functions of the FreePBX Endpoint Manager. This could allow them to manipulate telephony endpoints, potentially intercept calls, alter configurations, or disrupt telephony services.

Mitigation Strategies

Upgrade FreePBX Endpoint Manager to version 16.0.96 or later, or 17.0.10 or later, where the weak default password issue is fixed. Additionally, change the default 6-digit numeric app_password to a strong, complex password to prevent brute force attacks.

Hi! I’m here to help you understand CVE-2025-67513. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70