CVE-2025-67736

The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to the Administrator Control Panel (ACP) can leverage this SQL injection vulnerability to extract sensitive information from the database and execute code on the system as the `asterisk` user with chained elevation to `root` privileges. Users should upgrade to version 16.0.5 or 17.0.5 to receive a fix.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-632c-49p9-x7cw	Vendor Advisory
https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sangoma:freepbx::::::::
	cpe:2.3:a:sangoma:freepbx::::::::

History

07 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El módulo tts (Text to Speech) de FreePBX para FreePBX, una interfaz gráfica de usuario (GUI) basada en web de código abierto que gestiona Asterisk. Las versiones anteriores a la 16.0.5 y 17.0.5 son vulnerables a inyección SQL por usuarios autenticados con acceso de administrador. Los usuarios autenticados con acceso administrativo al Panel de Control del Administrador (ACP) pueden aprovechar esta vulnerabilidad de inyección SQL para extraer información sensible de la base de datos y ejecutar código en el sistema como el usuario 'asterisk' con escalada encadenada a privilegios de 'root'. Los usuarios deben actualizar a la versión 16.0.5 o 17.0.5 para recibir una solución.

Information

Published : 2025-12-16 01:15

Updated : 2026-10-07 19:10

NVD link : CVE-2025-67736

Mitre link : CVE-2025-67736

CVE.ORG link : CVE-2025-67736

JSON object : View

Products Affected

sangoma

freepbx

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-67736", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67736", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-17T04:56:07.674157Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FreePBX", "product": "tts", "versions": [{"status": "affected", "version": "< 16.0.5"}, {"status": "affected", "version": ">= 17.0.0, < 17.0.5"}]}]}], "published": "2025-12-16T01:15:52.513", "references": [{"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-632c-49p9-x7cw", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to the Administrator Control Panel (ACP) can leverage this SQL injection vulnerability to extract sensitive information from the database and execute code on the system as the `asterisk` user with chained elevation to `root` privileges. Users should upgrade to version 16.0.5 or 17.0.5 to receive a fix."}, {"lang": "es", "value": "El m\u00f3dulo tts (Text to Speech) de FreePBX para FreePBX, una interfaz gr\u00e1fica de usuario (GUI) basada en web de c\u00f3digo abierto que gestiona Asterisk. Las versiones anteriores a la 16.0.5 y 17.0.5 son vulnerables a inyecci\u00f3n SQL por usuarios autenticados con acceso de administrador. Los usuarios autenticados con acceso administrativo al Panel de Control del Administrador (ACP) pueden aprovechar esta vulnerabilidad de inyecci\u00f3n SQL para extraer informaci\u00f3n sensible de la base de datos y ejecutar c\u00f3digo en el sistema como el usuario 'asterisk' con escalada encadenada a privilegios de 'root'. Los usuarios deben actualizar a la versi\u00f3n 16.0.5 o 17.0.5 para recibir una soluci\u00f3n."}], "lastModified": "2026-10-07T19:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2C17CC2-690B-4CE9-9EC1-28DECA059952", "versionEndExcluding": "16.0.5", "versionStartIncluding": "16.0"}, {"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADED51B0-38B0-44A5-9116-A07EA67CA59A", "versionEndExcluding": "17.0.5", "versionStartIncluding": "17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}