CVE-2025-67722 is a local privilege escalation vulnerability in the FreePBX framework, specifically in its deprecated startup script 'amportal'. FreePBX is an open-source GUI managing Asterisk PBX systems. The vulnerability stems from an untrusted search path issue (CWE-426) where 'amportal' looks for the 'freepbx_engine' executable in the /etc/asterisk/ directory. This directory is typically writable by the 'asterisk' user and group, meaning any user with membership in the 'asterisk' group can place a malicious 'freepbx_engine' file there. When 'amportal' runs, it executes this file with root privileges, thereby allowing privilege escalation from a lower privileged user to root. The vulnerability affects FreePBX framework versions prior to 16.0.45 and between 17.0.0 and 17.0.24. The issue is mitigated in versions 16.0.45 and 17.0.24 and later. Exploitation requires local authenticated access and membership in the 'asterisk' group but does not require user interaction. Additional mitigations include verifying group membership, auditing the /etc/asterisk/ directory for unauthorized files, ensuring the 'live_dangerously' setting in asterisk.conf is set to 'no' (default), and avoiding unsafe dial plan functions that can manipulate the filesystem such as System() and FILE(). No public exploits have been reported to date, but the vulnerability poses a significant risk in environments where multiple users have 'asterisk' group membership.

This vulnerability allows an authenticated local user with membership in the 'asterisk' group to escalate privileges to root by placing a malicious executable in a writable directory that is trusted and executed by a root-owned startup script. The impact includes full system compromise, allowing attackers to gain complete control over the affected FreePBX server. This can lead to unauthorized access to sensitive telephony data, interception or manipulation of calls, disruption of telephony services, and potential lateral movement within the network. Organizations relying on FreePBX for critical communication infrastructure, especially in enterprise, government, and telecommunication sectors, face significant operational and reputational risks. The vulnerability's exploitation could also facilitate further attacks such as data exfiltration, installation of persistent backdoors, or launching attacks against connected systems. Given the requirement for local authenticated access and group membership, the risk is higher in environments with multiple users or weak internal access controls.

1. Upgrade FreePBX framework to version 16.0.45, 17.0.24, or later where the vulnerability is fixed. 2. Restrict membership of the 'asterisk' group strictly to trusted system administrators and service accounts; remove unnecessary users. 3. Regularly audit the /etc/asterisk/ directory for unauthorized or suspicious files, especially any 'freepbx_engine' files. 4. Verify that the 'live_dangerously' setting in /etc/asterisk/asterisk.conf is set to 'no' or left unconfigured (default is 'no') to prevent unsafe operations. 5. Avoid or carefully review custom dial plan applications and functions that can manipulate the filesystem, such as System(), FILE(), and similar calls, to reduce attack surface. 6. Implement strict local access controls and monitoring to detect unauthorized group membership changes or file modifications. 7. Consider disabling or removing the deprecated 'amportal' script if it is no longer required. 8. Employ host-based intrusion detection systems (HIDS) to monitor critical directories and binaries for unauthorized changes. 9. Educate administrators on the risks of untrusted search paths and the importance of secure file permissions in telephony systems.