Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-64328 7.2
Sangoma · FreePBX · Added 2026-02-03 · Published 2025-11-07
3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilitySangoma FreePBX OS Command Injection Vulnerability
VendorSangoma
ProductFreePBX
Date added2026-02-03
Due date2026-02-24
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-78
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.

NVD: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-08-29 02:41 UTC
Wall time0.3s
Searches1
Component defaultyes
Sources https://nvd.nist.gov/vuln/detail/CVE-2025-64328
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw
https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/
https://cloud.projectdiscovery.io/library/CVE-2025-64328
https://www.cve.org/CVERecord?id=CVE-2025-64328
https://www.tenable.com/plugins/nessus/298039
https://www.sentinelone.com/vulnerability-database/cve-2025-64328/
https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80/
https://sangomakb.atlassian.net/wiki/spaces/PG/pages/26640528

QC notes

warn component_extraction: Component 'filestore module (FreePBX 17) - SSH driver testconnection.php check_ssh_connect() function' matches or contains product name 'FreePBX ' — no specific component identified

Hunting hypothesis agent

Hunt /admin/ajax.php GETs with module=filestore, command=testconnection, driver=SSH, and backtick-delimited commands in the key parameter; look for sh -c mkdir -p or sh -c ssh-keygen spawned as the asterisk user.

Research details

Componentfilestore module (FreePBX 17) - SSH driver testconnection.php check_ssh_connect() function
PreconditionsThe attacker must have valid credentials for the FreePBX Administration Control Panel (ACP) with at least 'Allow FreePBX Administration Login' enabled (no specific role authorization required). The FreePBX server must be running version >= 17.0.2.36 and < 17.0.3. The filestore module must be accessible and the attacker must have network reachability to the administrative web interface (typically TCP 80/443). The HTTP Referer header must match the target host for the ajax request to be accepted. agent
DeliveryHTTP GET request to /admin/ajax.php with parameters module=filestore, command=testconnection, driver=SSH, and a malicious key parameter containing shell metacharacters (backticks or command substitution)
Public PoCyes
PoC URLs https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/
https://github.com/mcorybillington/CVE-2025-64328_FreePBX-framework-Command-Injection/blob/main/CVE-2025-64328.yaml
https://cloud.projectdiscovery.io/library/CVE-2025-64328 Third-party repos; verify before use.
Advisoryhttps://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw
Exploit notesExploitation is straightforward for any authenticated FreePBX admin user. The vulnerable check_ssh_connect() function passes the unsanitized 'key' parameter directly into exec() calls (mkdir -p and ssh-keygen) via two separate sinks. The 'key' parameter is injected via HTTP GET to /admin/ajax.php. PHP's dirname() preserves backticks when a '/' is present in the string, allowing command execution via Sink 1; Sink 2 directly concatenates $key into the shell command without any sanitization. A simple HTTP request with backtick-delimited commands in the key parameter achieves RCE as the asterisk user. Tenable Nessus plugin 298039 confirms 'Exploit Available: true' and 'Exploit Ease: Exploits are available'.
SummaryCVE-2025-64328 is a post-authentication OS command injection vulnerability in the FreePBX 17 filestore module, specifically within the check_ssh_connect() function in drivers/SSH/testconnection.php. An authenticated FreePBX user can inject arbitrary shell commands via the 'key' parameter in a GET request to /admin/ajax.php?module=filestore&command=testconnection&driver=SSH, achieving RCE as the asterisk user. Multiple public PoCs exist including a full writeup with curl examples and a Nuclei detection template; the vulnerability was added to CISA KEV on 2026-02-03.

Tia coverage

First reported2026-05-22

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2025-64328-sangoma-freepbx-os-command-injection-under-activeinj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub