SQL Injection in Freepbx Endpoint
CVE-2025-61675
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration functionality areas. Authentication with a known username is required to exploit these vulnerabilities. Successful exploitation allows authenticated users to execute arbitrary SQL queries against the database, potentially enabling access to sensitive data or modification of database contents. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17.
Vulnerability class: SQL Injection
Published · last modified .
EPSS exploit prediction
EPSS: 0.385 (98.6th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.385 · newest: 0.385 · change: 0.000
Affected products
- Freepbx Endpoint — versions < 16.0.92, >= 17.0.0, < 17.0.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-61675?
- CVE-2025-61675 is a vulnerability in Freepbx Endpoint, classified under SQL Injection. Published 2025-10-14.
- Is CVE-2025-61675 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.