CVE-2025-61678 is an authenticated arbitrary file upload vulnerability classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) found in the FreePBX Endpoint Manager module, which manages telephony endpoints. The vulnerability exists in versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17. It stems from improper validation and control over the fwbrand parameter, which an authenticated user can manipulate to alter the file path where uploaded files are stored. This allows an attacker with valid credentials to upload arbitrary files, including malicious webshells, to attacker-controlled locations on the server. The consequence is potential remote code execution, enabling attackers to execute arbitrary commands, escalate privileges, or maintain persistent access. The vulnerability does not require user interaction beyond authentication and has a CVSS 4.0 base score of 8.6, indicating high severity. The flaw has been addressed in the specified patched versions, and no public exploits have been reported yet. The vulnerability is particularly critical in telephony environments where FreePBX is deployed, as compromise can disrupt communications and expose sensitive data.

For European organizations, especially those operating VoIP and telephony infrastructure using FreePBX, this vulnerability poses a significant risk. Successful exploitation can lead to remote code execution, allowing attackers to gain control over telephony servers, intercept or manipulate calls, disrupt communications, and potentially pivot to other internal systems. This can affect confidentiality, integrity, and availability of critical communication services. Organizations in sectors such as telecommunications, government, finance, and healthcare that rely on FreePBX for internal or customer communications are particularly vulnerable. The requirement for authentication limits exposure to insiders or attackers who have obtained credentials, but credential theft or phishing could facilitate exploitation. The lack of known exploits in the wild suggests a window for proactive mitigation before widespread attacks occur.

1. Immediately upgrade FreePBX Endpoint Manager to version 16.0.92 or later for FreePBX 16, or version 17.0.6 or later for FreePBX 17 to apply the official patch. 2. Enforce strong authentication policies, including multi-factor authentication (MFA), to reduce the risk of credential compromise. 3. Restrict access to the FreePBX administrative interface to trusted networks and IP addresses using network segmentation and firewall rules. 4. Monitor logs for unusual file upload activity or changes to the fwbrand parameter. 5. Conduct regular audits of uploaded files and server directories to detect unauthorized files or webshells. 6. Implement application-layer protections such as web application firewalls (WAFs) to detect and block malicious upload attempts. 7. Educate administrators on the risks of credential phishing and enforce least privilege principles to limit the number of users with upload permissions. 8. Maintain up-to-date backups of configuration and system data to enable recovery in case of compromise.