Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-61678— FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter

Quick assessment

Affected
FreePBX endpointman
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreePBX Endpoint Manager是FreePBX开源的一款集中管理IP电话终端配置模块。 FreePBX Endpoint Manager 16.0.92之前版本和17.0.6之前版本存在代码问题漏洞，该漏洞源于fwbrand参数存在经过身份验证的任意文件上传，可能导致远程代码执行。

AI Predicted 8.1 Difficulty: Easy EPSS 43.68% · P99
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-61678

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter
Source: CVE Program / CVE List V5
Vulnerability Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. The fwbrand parameter allows an attacker to change the file path. Combined, these issues can result in a webshell being uploaded. Authentication with a known username is required to exploit this vulnerability. Successful exploitation allows authenticated users to upload arbitrary files to attacker-controlled paths on the server, potentially leading to remote code execution. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Vulnerability Title
FreePBX Endpoint Manager 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreePBX Endpoint Manager是FreePBX开源的一款集中管理IP电话终端配置模块。 FreePBX Endpoint Manager 16.0.92之前版本和17.0.6之前版本存在代码问题漏洞，该漏洞源于fwbrand参数存在经过身份验证的任意文件上传，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
FreePBX endpointman < 16.0.92 -

II. Public POCs for CVE-2025-61678

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-61678

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-61678 (1)

Same Patch Batch · FreePBX · 2025-10-14 · 4 CVEs total

CVE-2025-59051 FreePBX Endpoint Manager command injection via Network Scanning feature
CVE-2025-59429 FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status
CVE-2025-61675 FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configurati

IV. Related Vulnerabilities

Same product: endpointman
Same vendor: FreePBX
Same weakness: CWE-434

V. Comments for CVE-2025-61678

No comments yet

Leave a comment