Vulnerability Details CVE-2025-67722
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group. This means that a member of the **asterisk** group can add their own `freepbx_engine` file in `/etc/asterisk/` and upon `amportal` executing, it would exec that file with root permissions (even though the file was created and placed by a non-root user). Version 16.0.45 and 17.0.24 contain a fix for the issue. Other mitigation strategies are also available. Confirm only trusted local OS system users are members of the `asterisk` group. Look for suspicious files in the `/etc/asterisk/` directory (via Admin -> Config Edit in the GUI, or via CLI). Double-check that `live_dangerously = no` is set (or unconfigured, as the default is **no**) in `/etc/asterisk/asterisk.conf` file. Eliminate any unsafe custom use of Asterisk dial plan applications and functions that potentially can manipulate the file system, e.g., System(), FILE(), etc.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 1.0%
CVSS Severity
CVSS v3 Score 7.8
Products affected by CVE-2025-67722
-
cpe:2.3:a:sangoma:freepbx:16.0
-
cpe:2.3:a:sangoma:freepbx:16.0.10
-
cpe:2.3:a:sangoma:freepbx:16.0.10.1
-
cpe:2.3:a:sangoma:freepbx:16.0.10.10
-
cpe:2.3:a:sangoma:freepbx:16.0.10.11
-
cpe:2.3:a:sangoma:freepbx:16.0.10.12
-
cpe:2.3:a:sangoma:freepbx:16.0.10.13
-
cpe:2.3:a:sangoma:freepbx:16.0.10.14
-
cpe:2.3:a:sangoma:freepbx:16.0.10.15
-
cpe:2.3:a:sangoma:freepbx:16.0.10.16
-
cpe:2.3:a:sangoma:freepbx:16.0.10.17
-
cpe:2.3:a:sangoma:freepbx:16.0.10.18
-
cpe:2.3:a:sangoma:freepbx:16.0.10.19
-
cpe:2.3:a:sangoma:freepbx:16.0.10.2
-
cpe:2.3:a:sangoma:freepbx:16.0.10.20
-
cpe:2.3:a:sangoma:freepbx:16.0.10.21
-
cpe:2.3:a:sangoma:freepbx:16.0.10.22
-
cpe:2.3:a:sangoma:freepbx:16.0.10.23
-
cpe:2.3:a:sangoma:freepbx:16.0.10.24
-
cpe:2.3:a:sangoma:freepbx:16.0.10.25
-
cpe:2.3:a:sangoma:freepbx:16.0.10.26
-
cpe:2.3:a:sangoma:freepbx:16.0.10.27
-
cpe:2.3:a:sangoma:freepbx:16.0.10.28
-
cpe:2.3:a:sangoma:freepbx:16.0.10.29
-
cpe:2.3:a:sangoma:freepbx:16.0.10.3
-
cpe:2.3:a:sangoma:freepbx:16.0.10.30
-
cpe:2.3:a:sangoma:freepbx:16.0.10.31
-
cpe:2.3:a:sangoma:freepbx:16.0.10.32
-
cpe:2.3:a:sangoma:freepbx:16.0.10.33
-
cpe:2.3:a:sangoma:freepbx:16.0.10.34
-
cpe:2.3:a:sangoma:freepbx:16.0.10.35
-
cpe:2.3:a:sangoma:freepbx:16.0.10.36
-
cpe:2.3:a:sangoma:freepbx:16.0.10.37
-
cpe:2.3:a:sangoma:freepbx:16.0.10.38
-
cpe:2.3:a:sangoma:freepbx:16.0.10.39
-
cpe:2.3:a:sangoma:freepbx:16.0.10.4
-
cpe:2.3:a:sangoma:freepbx:16.0.10.40
-
cpe:2.3:a:sangoma:freepbx:16.0.10.41
-
cpe:2.3:a:sangoma:freepbx:16.0.10.42
-
cpe:2.3:a:sangoma:freepbx:16.0.10.43
-
cpe:2.3:a:sangoma:freepbx:16.0.10.44
-
cpe:2.3:a:sangoma:freepbx:16.0.10.45
-
cpe:2.3:a:sangoma:freepbx:16.0.10.46
-
cpe:2.3:a:sangoma:freepbx:16.0.10.47
-
cpe:2.3:a:sangoma:freepbx:16.0.10.48
-
cpe:2.3:a:sangoma:freepbx:16.0.10.49
-
cpe:2.3:a:sangoma:freepbx:16.0.10.5
-
cpe:2.3:a:sangoma:freepbx:16.0.10.50
-
cpe:2.3:a:sangoma:freepbx:16.0.10.51
-
cpe:2.3:a:sangoma:freepbx:16.0.10.6
-
cpe:2.3:a:sangoma:freepbx:16.0.10.7
-
cpe:2.3:a:sangoma:freepbx:16.0.10.8
-
cpe:2.3:a:sangoma:freepbx:16.0.10.9
-
cpe:2.3:a:sangoma:freepbx:16.0.11
-
cpe:2.3:a:sangoma:freepbx:16.0.12
-
cpe:2.3:a:sangoma:freepbx:16.0.13
-
cpe:2.3:a:sangoma:freepbx:16.0.14
-
cpe:2.3:a:sangoma:freepbx:16.0.15
-
cpe:2.3:a:sangoma:freepbx:16.0.16
-
cpe:2.3:a:sangoma:freepbx:16.0.17
-
cpe:2.3:a:sangoma:freepbx:16.0.18
-
cpe:2.3:a:sangoma:freepbx:16.0.19
-
cpe:2.3:a:sangoma:freepbx:16.0.19.1
-
cpe:2.3:a:sangoma:freepbx:16.0.19.10
-
cpe:2.3:a:sangoma:freepbx:16.0.19.11
-
cpe:2.3:a:sangoma:freepbx:16.0.19.12
-
cpe:2.3:a:sangoma:freepbx:16.0.19.13
-
cpe:2.3:a:sangoma:freepbx:16.0.19.14
-
cpe:2.3:a:sangoma:freepbx:16.0.19.15
-
cpe:2.3:a:sangoma:freepbx:16.0.19.16
-
cpe:2.3:a:sangoma:freepbx:16.0.19.17
-
cpe:2.3:a:sangoma:freepbx:16.0.19.18
-
cpe:2.3:a:sangoma:freepbx:16.0.19.2
-
cpe:2.3:a:sangoma:freepbx:16.0.19.3
-
cpe:2.3:a:sangoma:freepbx:16.0.19.4
-
cpe:2.3:a:sangoma:freepbx:16.0.19.5
-
cpe:2.3:a:sangoma:freepbx:16.0.19.6
-
cpe:2.3:a:sangoma:freepbx:16.0.19.7
-
cpe:2.3:a:sangoma:freepbx:16.0.19.8
-
cpe:2.3:a:sangoma:freepbx:16.0.19.9
-
cpe:2.3:a:sangoma:freepbx:16.0.2
-
cpe:2.3:a:sangoma:freepbx:16.0.20
-
cpe:2.3:a:sangoma:freepbx:16.0.21
-
cpe:2.3:a:sangoma:freepbx:16.0.21.1
-
cpe:2.3:a:sangoma:freepbx:16.0.21.10
-
cpe:2.3:a:sangoma:freepbx:16.0.21.11
-
cpe:2.3:a:sangoma:freepbx:16.0.21.12
-
cpe:2.3:a:sangoma:freepbx:16.0.21.13
-
cpe:2.3:a:sangoma:freepbx:16.0.21.14
-
cpe:2.3:a:sangoma:freepbx:16.0.21.15
-
cpe:2.3:a:sangoma:freepbx:16.0.21.16
-
cpe:2.3:a:sangoma:freepbx:16.0.21.17
-
cpe:2.3:a:sangoma:freepbx:16.0.21.18
-
cpe:2.3:a:sangoma:freepbx:16.0.21.19
-
cpe:2.3:a:sangoma:freepbx:16.0.21.2
-
cpe:2.3:a:sangoma:freepbx:16.0.21.20
-
cpe:2.3:a:sangoma:freepbx:16.0.21.21
-
cpe:2.3:a:sangoma:freepbx:16.0.21.3
-
cpe:2.3:a:sangoma:freepbx:16.0.21.4
-
cpe:2.3:a:sangoma:freepbx:16.0.21.5
-
cpe:2.3:a:sangoma:freepbx:16.0.21.6
-
cpe:2.3:a:sangoma:freepbx:16.0.21.7
-
cpe:2.3:a:sangoma:freepbx:16.0.21.8
-
cpe:2.3:a:sangoma:freepbx:16.0.21.9
-
cpe:2.3:a:sangoma:freepbx:16.0.22
-
cpe:2.3:a:sangoma:freepbx:16.0.23
-
cpe:2.3:a:sangoma:freepbx:16.0.24
-
cpe:2.3:a:sangoma:freepbx:16.0.25
-
cpe:2.3:a:sangoma:freepbx:16.0.26
-
cpe:2.3:a:sangoma:freepbx:16.0.27
-
cpe:2.3:a:sangoma:freepbx:16.0.28
-
cpe:2.3:a:sangoma:freepbx:16.0.29
-
cpe:2.3:a:sangoma:freepbx:16.0.3
-
cpe:2.3:a:sangoma:freepbx:16.0.30
-
cpe:2.3:a:sangoma:freepbx:16.0.31
-
cpe:2.3:a:sangoma:freepbx:16.0.32
-
cpe:2.3:a:sangoma:freepbx:16.0.33
-
cpe:2.3:a:sangoma:freepbx:16.0.34
-
cpe:2.3:a:sangoma:freepbx:16.0.35
-
cpe:2.3:a:sangoma:freepbx:16.0.36
-
cpe:2.3:a:sangoma:freepbx:16.0.37
-
cpe:2.3:a:sangoma:freepbx:16.0.38
-
cpe:2.3:a:sangoma:freepbx:16.0.39
-
cpe:2.3:a:sangoma:freepbx:16.0.4
-
cpe:2.3:a:sangoma:freepbx:16.0.40
-
cpe:2.3:a:sangoma:freepbx:16.0.40.1
-
cpe:2.3:a:sangoma:freepbx:16.0.40.10
-
cpe:2.3:a:sangoma:freepbx:16.0.40.11
-
cpe:2.3:a:sangoma:freepbx:16.0.40.12
-
cpe:2.3:a:sangoma:freepbx:16.0.40.13
-
cpe:2.3:a:sangoma:freepbx:16.0.40.14
-
cpe:2.3:a:sangoma:freepbx:16.0.40.15
-
cpe:2.3:a:sangoma:freepbx:16.0.40.16
-
cpe:2.3:a:sangoma:freepbx:16.0.40.17
-
cpe:2.3:a:sangoma:freepbx:16.0.40.18
-
cpe:2.3:a:sangoma:freepbx:16.0.40.19
-
cpe:2.3:a:sangoma:freepbx:16.0.40.2
-
cpe:2.3:a:sangoma:freepbx:16.0.40.20
-
cpe:2.3:a:sangoma:freepbx:16.0.40.21
-
cpe:2.3:a:sangoma:freepbx:16.0.40.3
-
cpe:2.3:a:sangoma:freepbx:16.0.40.4
-
cpe:2.3:a:sangoma:freepbx:16.0.40.5
-
cpe:2.3:a:sangoma:freepbx:16.0.40.6
-
cpe:2.3:a:sangoma:freepbx:16.0.40.7
-
cpe:2.3:a:sangoma:freepbx:16.0.40.8
-
cpe:2.3:a:sangoma:freepbx:16.0.40.9
-
cpe:2.3:a:sangoma:freepbx:16.0.41
-
cpe:2.3:a:sangoma:freepbx:16.0.42
-
cpe:2.3:a:sangoma:freepbx:16.0.43
-
cpe:2.3:a:sangoma:freepbx:16.0.44
-
cpe:2.3:a:sangoma:freepbx:16.0.5
-
cpe:2.3:a:sangoma:freepbx:16.0.6
-
cpe:2.3:a:sangoma:freepbx:16.0.7
-
cpe:2.3:a:sangoma:freepbx:16.0.8
-
cpe:2.3:a:sangoma:freepbx:16.0.9
-
cpe:2.3:a:sangoma:freepbx:17.0
-
cpe:2.3:a:sangoma:freepbx:17.0.1
-
cpe:2.3:a:sangoma:freepbx:17.0.10
-
cpe:2.3:a:sangoma:freepbx:17.0.11
-
cpe:2.3:a:sangoma:freepbx:17.0.12
-
cpe:2.3:a:sangoma:freepbx:17.0.13
-
cpe:2.3:a:sangoma:freepbx:17.0.14
-
cpe:2.3:a:sangoma:freepbx:17.0.14.1
-
cpe:2.3:a:sangoma:freepbx:17.0.14.10
-
cpe:2.3:a:sangoma:freepbx:17.0.14.11
-
cpe:2.3:a:sangoma:freepbx:17.0.14.12
-
cpe:2.3:a:sangoma:freepbx:17.0.14.13
-
cpe:2.3:a:sangoma:freepbx:17.0.14.14
-
cpe:2.3:a:sangoma:freepbx:17.0.14.15
-
cpe:2.3:a:sangoma:freepbx:17.0.14.16
-
cpe:2.3:a:sangoma:freepbx:17.0.14.17
-
cpe:2.3:a:sangoma:freepbx:17.0.14.18
-
cpe:2.3:a:sangoma:freepbx:17.0.14.19
-
cpe:2.3:a:sangoma:freepbx:17.0.14.2
-
cpe:2.3:a:sangoma:freepbx:17.0.14.20
-
cpe:2.3:a:sangoma:freepbx:17.0.14.21
-
cpe:2.3:a:sangoma:freepbx:17.0.14.22
-
cpe:2.3:a:sangoma:freepbx:17.0.14.23
-
cpe:2.3:a:sangoma:freepbx:17.0.14.24
-
cpe:2.3:a:sangoma:freepbx:17.0.14.25
-
cpe:2.3:a:sangoma:freepbx:17.0.14.26
-
cpe:2.3:a:sangoma:freepbx:17.0.14.27
-
cpe:2.3:a:sangoma:freepbx:17.0.14.28
-
cpe:2.3:a:sangoma:freepbx:17.0.14.29
-
cpe:2.3:a:sangoma:freepbx:17.0.14.3
-
cpe:2.3:a:sangoma:freepbx:17.0.14.30
-
cpe:2.3:a:sangoma:freepbx:17.0.14.31
-
cpe:2.3:a:sangoma:freepbx:17.0.14.32
-
cpe:2.3:a:sangoma:freepbx:17.0.14.33
-
cpe:2.3:a:sangoma:freepbx:17.0.14.34
-
cpe:2.3:a:sangoma:freepbx:17.0.14.35
-
cpe:2.3:a:sangoma:freepbx:17.0.14.36
-
cpe:2.3:a:sangoma:freepbx:17.0.14.37
-
cpe:2.3:a:sangoma:freepbx:17.0.14.38
-
cpe:2.3:a:sangoma:freepbx:17.0.14.4
-
cpe:2.3:a:sangoma:freepbx:17.0.14.5
-
cpe:2.3:a:sangoma:freepbx:17.0.14.6
-
cpe:2.3:a:sangoma:freepbx:17.0.14.7
-
cpe:2.3:a:sangoma:freepbx:17.0.14.8
-
cpe:2.3:a:sangoma:freepbx:17.0.14.9
-
cpe:2.3:a:sangoma:freepbx:17.0.15
-
cpe:2.3:a:sangoma:freepbx:17.0.15.1
-
cpe:2.3:a:sangoma:freepbx:17.0.15.10
-
cpe:2.3:a:sangoma:freepbx:17.0.15.11
-
cpe:2.3:a:sangoma:freepbx:17.0.15.12
-
cpe:2.3:a:sangoma:freepbx:17.0.15.13
-
cpe:2.3:a:sangoma:freepbx:17.0.15.14
-
cpe:2.3:a:sangoma:freepbx:17.0.15.15
-
cpe:2.3:a:sangoma:freepbx:17.0.15.16
-
cpe:2.3:a:sangoma:freepbx:17.0.15.17
-
cpe:2.3:a:sangoma:freepbx:17.0.15.18
-
cpe:2.3:a:sangoma:freepbx:17.0.15.19
-
cpe:2.3:a:sangoma:freepbx:17.0.15.2
-
cpe:2.3:a:sangoma:freepbx:17.0.15.20
-
cpe:2.3:a:sangoma:freepbx:17.0.15.21
-
cpe:2.3:a:sangoma:freepbx:17.0.15.22
-
cpe:2.3:a:sangoma:freepbx:17.0.15.23
-
cpe:2.3:a:sangoma:freepbx:17.0.15.24
-
cpe:2.3:a:sangoma:freepbx:17.0.15.25
-
cpe:2.3:a:sangoma:freepbx:17.0.15.26
-
cpe:2.3:a:sangoma:freepbx:17.0.15.27
-
cpe:2.3:a:sangoma:freepbx:17.0.15.28
-
cpe:2.3:a:sangoma:freepbx:17.0.15.3
-
cpe:2.3:a:sangoma:freepbx:17.0.15.4
-
cpe:2.3:a:sangoma:freepbx:17.0.15.5
-
cpe:2.3:a:sangoma:freepbx:17.0.15.6
-
cpe:2.3:a:sangoma:freepbx:17.0.15.7
-
cpe:2.3:a:sangoma:freepbx:17.0.15.8
-
cpe:2.3:a:sangoma:freepbx:17.0.15.9
-
cpe:2.3:a:sangoma:freepbx:17.0.16
-
cpe:2.3:a:sangoma:freepbx:17.0.17
-
cpe:2.3:a:sangoma:freepbx:17.0.17.1
-
cpe:2.3:a:sangoma:freepbx:17.0.18
-
cpe:2.3:a:sangoma:freepbx:17.0.19
-
cpe:2.3:a:sangoma:freepbx:17.0.19.1
-
cpe:2.3:a:sangoma:freepbx:17.0.19.10
-
cpe:2.3:a:sangoma:freepbx:17.0.19.11
-
cpe:2.3:a:sangoma:freepbx:17.0.19.12
-
cpe:2.3:a:sangoma:freepbx:17.0.19.13
-
cpe:2.3:a:sangoma:freepbx:17.0.19.14
-
cpe:2.3:a:sangoma:freepbx:17.0.19.15
-
cpe:2.3:a:sangoma:freepbx:17.0.19.16
-
cpe:2.3:a:sangoma:freepbx:17.0.19.17
-
cpe:2.3:a:sangoma:freepbx:17.0.19.18
-
cpe:2.3:a:sangoma:freepbx:17.0.19.19
-
cpe:2.3:a:sangoma:freepbx:17.0.19.2
-
cpe:2.3:a:sangoma:freepbx:17.0.19.20
-
cpe:2.3:a:sangoma:freepbx:17.0.19.21
-
cpe:2.3:a:sangoma:freepbx:17.0.19.22
-
cpe:2.3:a:sangoma:freepbx:17.0.19.23
-
cpe:2.3:a:sangoma:freepbx:17.0.19.24
-
cpe:2.3:a:sangoma:freepbx:17.0.19.25
-
cpe:2.3:a:sangoma:freepbx:17.0.19.26
-
cpe:2.3:a:sangoma:freepbx:17.0.19.27
-
cpe:2.3:a:sangoma:freepbx:17.0.19.28
-
cpe:2.3:a:sangoma:freepbx:17.0.19.29
-
cpe:2.3:a:sangoma:freepbx:17.0.19.3
-
cpe:2.3:a:sangoma:freepbx:17.0.19.30
-
cpe:2.3:a:sangoma:freepbx:17.0.19.31
-
cpe:2.3:a:sangoma:freepbx:17.0.19.32
-
cpe:2.3:a:sangoma:freepbx:17.0.19.33
-
cpe:2.3:a:sangoma:freepbx:17.0.19.34
-
cpe:2.3:a:sangoma:freepbx:17.0.19.35
-
cpe:2.3:a:sangoma:freepbx:17.0.19.4
-
cpe:2.3:a:sangoma:freepbx:17.0.19.5
-
cpe:2.3:a:sangoma:freepbx:17.0.19.6
-
cpe:2.3:a:sangoma:freepbx:17.0.19.7
-
cpe:2.3:a:sangoma:freepbx:17.0.19.8
-
cpe:2.3:a:sangoma:freepbx:17.0.19.9
-
cpe:2.3:a:sangoma:freepbx:17.0.2
-
cpe:2.3:a:sangoma:freepbx:17.0.20
-
cpe:2.3:a:sangoma:freepbx:17.0.20.1
-
cpe:2.3:a:sangoma:freepbx:17.0.21
-
cpe:2.3:a:sangoma:freepbx:17.0.3
-
cpe:2.3:a:sangoma:freepbx:17.0.4
-
cpe:2.3:a:sangoma:freepbx:17.0.5
-
cpe:2.3:a:sangoma:freepbx:17.0.6
-
cpe:2.3:a:sangoma:freepbx:17.0.7
-
cpe:2.3:a:sangoma:freepbx:17.0.8
-
cpe:2.3:a:sangoma:freepbx:17.0.9