CVE-2025-64328
Sangoma FreePBX OS Command Injection Vulnerability
Description
CVE-2025-64328 is a high-severity post-authentication OS command injection vulnerability in the FreePBX Endpoint Manager's filestore module that allows an authenticated administrator to execute arbitrary commands on the underlying operating system. With a CVSS v3.1 base score of 7.2, the flaw resides in the testconnection function's check_ssh_connect() method, where user-supplied input is passed to shell commands without proper sanitization. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 24, 2026, and the ransomware association is currently classified as unknown. The EPSS score of 17.45% at the 94.9th percentile indicates extremely high exploitation activity, placing this among the top 5% of tracked vulnerabilities and confirming aggressive real-world targeting of FreePBX installations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sangoma | filestore | >= 17.0.2.36, < 17.0.3 |
References
- https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2(Product)
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw(Vendor Advisory, Mitigation)
- https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64328(Third Party Advisory, US Government Resource)
- https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp(Exploit, Third Party Advisory)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-64328 is classified under CWE-78 (OS Command Injection). This weakness occurs when software constructs operating system commands using externally influenced input without proper neutralization of special elements that could alter the intended command structure. In the FreePBX filestore module, the check_ssh_connect() function within the testconnection handler builds a shell command that incorporates user-supplied parameters from the administrative interface. An authenticated attacker can inject shell metacharacters into these parameters, causing the server to execute arbitrary commands alongside or instead of the legitimate SSH connection test. While the vulnerability requires administrator-level authentication, the ability to achieve remote command execution on the underlying Linux system makes it a critical post-exploitation tool, particularly in environments where administrative credentials have been obtained through other means. Learn more about CWE-78
Impact Analysis
The impact of CVE-2025-64328 spans all three dimensions of the CIA triad with high severity. Confidentiality is fully compromised because command execution on the FreePBX server grants access to call detail records, voicemail recordings, SIP credentials, PBX configuration files including trunk passwords, and any other data stored on the system. FreePBX servers often contain sensitive business communication data and may have access to internal network resources through their network position.
Integrity faces maximum impact as the attacker can modify PBX configurations, alter call routing rules, inject malicious dial plans, install backdoors, and modify system files. The attacker could redirect calls to external numbers for eavesdropping, modify voicemail greetings for social engineering, or alter the PBX configuration to facilitate toll fraud by routing expensive international calls through the compromised system.
Availability is critically threatened because the attacker can disrupt telephony services by shutting down Asterisk processes, corrupting configurations, or deploying destructive payloads. The EPSS score of 17.45% at the 94.9th percentile combined with the KEV listing confirms active exploitation in the wild. Published exploit research from Fortinet documents weaponized web shells being deployed through this vulnerability, and the FreePBX security advisory provides detailed exploitation information. Affected versions are the filestore module 17.0.2.36 and above before 17.0.3. The ransomware association remains unknown, but the level of system access achieved is sufficient for ransomware deployment.
Exploit Maturity
CVE-2025-64328 demonstrates very high exploit maturity with public exploit code and documented weaponization. The EPSS score of 17.45% at the 94.9th percentile places it among the most actively exploited vulnerabilities in the current threat landscape. CISA's KEV listing with a remediation deadline of February 24, 2026 confirms active exploitation. The FreePBX security advisory (GHSA-vm9p-46mv-5xvw) is tagged as both Exploit and Vendor Advisory, providing detailed vulnerability information. The vulnerable source code is publicly available on GitHub, enabling straightforward exploitation by anyone who reviews the code.
Fortinet's threat research documents the "EncystPHP" web shell being deployed through exploitation of this vulnerability, indicating that threat actors have developed full attack toolchains that exploit the command injection to install persistent backdoors on compromised FreePBX systems. While the vulnerability requires administrator-level authentication (PR:H in the CVSS vector), FreePBX administrative interfaces are frequently exposed to the internet with default or weak credentials, and the administrative credentials may be obtained through phishing, credential stuffing, or exploitation of other vulnerabilities. FreePBX's own blog post acknowledges the severity of the security issue.
Remediation
-
Update the FreePBX filestore module to version 17.0.3 or later immediately. This version patches the command injection vulnerability in the check_ssh_connect() function. Apply the update through the FreePBX Module Admin interface or download it directly from the FreePBX repository. Given the 17.45% EPSS score and active exploitation with web shell deployment, any delay in patching exposes the system to likely compromise.
-
Restrict administrative interface access to trusted networks as an immediate compensating control. FreePBX administration should never be exposed directly to the internet. Implement firewall rules to limit access to the administration port to specific management IP addresses, and require VPN access for remote administration. This reduces the attack surface significantly even though the vulnerability requires authentication.
-
Audit the FreePBX server for indicators of compromise by searching for web shells, unauthorized files in the web root directory, unexpected cron jobs, modified system files, and unfamiliar user accounts. Specifically look for the "EncystPHP" web shell pattern documented by Fortinet, and check Apache/nginx access logs for suspicious requests to the testconnection endpoint.
-
Change all administrative credentials for the FreePBX system after patching, including the FreePBX web interface password, Asterisk Manager Interface (AMI) credentials, SIP trunk passwords, and any database credentials. Implement strong, unique passwords and enable two-factor authentication if supported by your FreePBX version.
-
Review call detail records and PBX configuration for signs of unauthorized modification. Check for unexpected outbound call patterns that might indicate toll fraud, verify that SIP trunk configurations have not been altered to redirect traffic, and ensure that voicemail configurations and dial plans match expected settings.
Technical Details
CVE-2025-64328 is an OS command injection vulnerability in the FreePBX Endpoint Manager's filestore module, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Breaking down the vector: Attack Vector (AV:N) confirms remote network exploitation through the web interface. Attack Complexity (AC:L) means the exploit is straightforward with no special conditions required. Privileges Required (PR:H) indicates the attacker needs administrator-level access to the FreePBX web interface, which is the primary mitigating factor. User Interaction (UI:N) confirms no additional user action is needed. Scope (S:U) keeps the impact within the FreePBX server context, though this includes full operating system access.
The vulnerability exists in the testconnection.php file within the SSH driver of the filestore module. The check_ssh_connect() function is designed to test SSH connectivity to remote storage endpoints as part of the filestore configuration process. The function takes user-supplied parameters including hostname, username, and potentially other connection details, and constructs a shell command to test the SSH connection. The parameters are incorporated into the command string without proper escaping or sanitization, allowing an attacker to inject shell metacharacters that break out of the intended command context and execute arbitrary OS commands.
The affected versions are filestore module 17.0.2.36 through versions prior to 17.0.3. The FreePBX system typically runs on Linux with the Asterisk process running as a dedicated user that has significant system privileges, including access to telephony configuration files, call recordings, and often database credentials. The fix in version 17.0.3 addresses the root cause by implementing proper input validation and command parameterization to prevent shell metacharacter injection.
Frequently Asked Questions
What is CVE-2025-64328?
CVE-2025-64328 is a high-severity command injection vulnerability in the FreePBX filestore module that allows an authenticated administrator to execute arbitrary operating system commands on the FreePBX server. It carries a CVSS score of 7.2 and has been added to CISA's KEV catalog.
Does an attacker need credentials to exploit CVE-2025-64328?
Yes, the vulnerability requires administrator-level authentication to the FreePBX web interface. However, FreePBX admin panels are frequently exposed to the internet with weak credentials, and the high EPSS score of 17.45% indicates that attackers are successfully exploiting this at scale, likely through credential-based attacks.
What are attackers doing after exploiting this vulnerability?
Security researchers at Fortinet have documented threat actors deploying the "EncystPHP" web shell through exploitation of this vulnerability, providing persistent backdoor access to compromised FreePBX servers. This enables ongoing access for data theft, call interception, and lateral movement.
Which FreePBX versions are affected?
The filestore module versions 17.0.2.36 and above before 17.0.3 are affected. Update to version 17.0.3 or later through the FreePBX Module Admin interface to resolve the vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.