CVE-2025-61678

CVE-2025-61678 is an authenticated arbitrary file upload vulnerability (CWE-434) in the FreePBX Endpoint Manager module, which is used to provision telephony endpoints on FreePBX PBX servers. An attacker who is authenticated (the advisory notes only a known username is required) sends a crafted upload request in which the fwbrand parameter is manipulated, allowing the upload path to be changed so that arbitrary files are written to attacker-controlled locations on the server. By placing a webshell in a web-reachable directory, the attacker can escalate the file upload into remote code execution on the PBX host. Affected deployments are FreePBX 16 systems running Endpoint Manager versions before 16.0.92 and FreePBX 17 systems running versions before 17.0.6. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 50.2% probability of exploitation within 30 days (99th percentile), and the fix shipped as part of FreePBX's recent batch of critical RCE-enabling patches, so remediation should be treated as urgent.

What to do: Upgrade the Endpoint Manager module to version 16.0.92 on FreePBX 16 or 17.0.6 on FreePBX 17 via Module Admin/fwconsole. Because exploitation requires authentication with a known username, restrict and review administrative access to the FreePBX web UI and audit admin accounts (particularly given the related AUTHTYPE bypass and SQLi fixes in the same patch batch), and check upload and firmware paths for unexpected PHP or webshell files.