CVE-2025-61675

CVE-2025-61675 is a SQL injection flaw (CWE-89) in the FreePBX Endpoint Manager module, which is used to provision and manage telephony endpoints. An attacker who already has a valid login must send crafted requests to multiple parameters in the basestation, model, firmware, and custom extension configuration areas, causing arbitrary SQL queries to run against the FreePBX database. Successful exploitation can expose sensitive database contents or modify records stored in the system. FreePBX 16 deployments running Endpoint Manager before 16.0.92 and FreePBX 17 deployments running it before 17.0.6 are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, but a 39% EPSS probability of exploitation within 30 days (98th percentile) indicates defenders should patch promptly.

What to do: Update the Endpoint Manager module to 16.0.92 on FreePBX 16 or 17.0.6 on FreePBX 17 via the Module Admin interface. Restrict access to the FreePBX administration interface to trusted networks or VPN users, since a known username is required to exploit this flaw. Given related advisories for FreePBX covering file-upload and AUTHTYPE bypass flaws enabling RCE, review and apply all outstanding FreePBX module and core updates.