CVE-2025-67722
📋 TL;DR
This CVE describes an authenticated local privilege escalation vulnerability in FreePBX's deprecated amportal startup script. Attackers who are members of the asterisk group can create malicious files that execute with root permissions when amportal runs. This affects FreePBX installations prior to versions 16.0.45 and 17.0.24.
💻 Affected Systems
- FreePBX
📦 What is this software?
Freepbx by Sangoma
Freepbx by Sangoma
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where an authenticated attacker gains root privileges, potentially leading to full control of the FreePBX server and adjacent systems.
Likely Case
Local privilege escalation allowing attackers to execute arbitrary code as root, modify system configurations, and access sensitive data.
If Mitigated
Limited impact with proper group membership controls and file monitoring in place.
🎯 Exploit Status
Exploitation requires authenticated access and membership in the asterisk group.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.45 and 17.0.24
Vendor Advisory: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p42w-v77m-hfp8
Restart Required: Yes
Instructions:
1. Update FreePBX framework to version 16.0.45 or 17.0.24 or later. 2. Restart affected services. 3. Verify the update was successful.
🔧 Temporary Workarounds
Remove unauthorized asterisk group members
linuxReview and remove any untrusted users from the asterisk group
grep '^asterisk:' /etc/group
sudo usermod -G <group1>,<group2> username
Monitor /etc/asterisk directory
linuxRegularly check for suspicious files in the vulnerable directory
ls -la /etc/asterisk/
find /etc/asterisk/ -type f -name 'freepbx_engine'
🧯 If You Can't Patch
- Review and restrict asterisk group membership to trusted users only
- Monitor /etc/asterisk directory for unauthorized file creation and set strict permissions
🔍 How to Verify
Check if Vulnerable:
Check FreePBX version and verify if users are in asterisk group: fwconsole ma list | grep framework && grep '^asterisk:' /etc/groupCheck Version:
fwconsole ma list | grep frameworkVerify Fix Applied:
Verify FreePBX framework version is 16.0.45+ or 17.0.24+: fwconsole ma list | grep framework📡 Detection & Monitoring
Log Indicators:
- Unexpected file creation in /etc/asterisk/
- Suspicious amportal script execution
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
File creation events in /etc/asterisk/ directory or amportal process execution