CVE-2025-64328 Sangoma FreePBX OS Command Injection Under Active Exploitation

CVE-2025-64328 is a CWE-78 OS command injection in the filestore module of FreePBX Endpoint Manager, present in versions 17.0.2.36 through every release below 17.0.3. The flaw sits in the testconnection check_ssh_connect() function under drivers/SSH/testconnection.php and hands shell execution as the asterisk user to anyone holding an authenticated session with a known username on the FreePBX Administration panel. FreePBX fixed it in filestore 17.0.3 and published GHSA-vm9p-46mv-5xvw on November 5, 2025; NVD published the CVE record November 7, 2025, scoring CVSS 3.1 7.2 and CVSS 4.0 base 8.6, both network vector with high privileges required. The vulnerable code was introduced around March 2025, so any system that pulled Endpoint Manager builds after that date without refreshing the module carries it. CISA added the CVE to the KEV catalog on February 3, 2026, and FortiGuard Labs had already documented weaponization: the EncystPHP web shell deployed through this bug in incidents starting early December 2025, attributed to the INJ3CTOR3 actor group.

The authentication requirement is the whole story, and it is why this outranks thirty other command-injection tickets. PBX admin panels are where organizations park weak, shared, never-rotated credentials, frequently exposed to the internet for remote phone provisioning; one such password converts directly into code execution, and from there EncystPHP showed the full chain: reading database credentials from /etc/freepbx.conf, creating a UID 0 user named newfpbx, injecting an SSH key, holding port 22 open, and abusing the telephony stack for outbound calls. Fortinet's assessment is that any successful exploitation of this vulnerability should be treated as a full compromise, not a web shell cleanup. The campaign also deletes competing web shells by scanning for strings like b3d0r and Badr, which marks FreePBX hosts as a contested, actively monetized target class. Note the timeline: exploitable code since March 2025, disclosure November 2025, KEV with a February 24, 2026 federal deadline, and the story still resurfacing in September 2026. The unpatched tail is long, and everyone still exposed now is exposed by neglect, not surprise.

Patch first: update the filestore module to 17.0.3 or later through Module Admin or fwconsole and confirm the running version, since nothing below 17.0.3 is safe. Restrict the admin GUI with the FreePBX Firewall module and deny hostile networks, per the vendor advisory, then rotate every admin credential on the assumption one is known. Hunt for the documented EncystPHP artifacts: a newfpbx account or any UID 0 entry in /etc/passwd, injected keys in /root/.ssh/authorized_keys, web shells at /var/www/html/admin/views/ajax.php and /var/www/html/rest_phones/ajax.php plus copies under digium_phones, phones, fpbxphones and freepbxphones directories, license.php under /var/www/html/admin/modules/freepbx_ha/, crontab entries writing /var/lib/asterisk/bin/zen2, devnull, devnull2 or devnull23, leftovers in /var/spool/asterisk/tmp/ (serv, test.sh), and an /var/www/html/admin/views/.htaccess rewrite pointing whitespace-prefixed requests at config.php. Check timestamps on those files too; the dropper forges them against footer.php. Block 45.234.176.202, 187.108.1.130, and crm.razatelefonia.pro, and match Fortinet's signatures PHP/EncystPHP.A!tr, BASH/EncystPHP.A!tr and IPS rule 59448 where available.

Two developments would change the assessment. A pre-auth variant, or mass scanning telemetry against the admin panel that does not require valid credentials, would collapse the last barrier and turn this into emergency patching for every exposed PBX. And any new FreePBX or Elastix CVE entering KEV should be read as INJ3CTOR3 continuing a pattern the group has run since CVE-2019-19006 in 2020 and CVE-2021-45461 against Elastix in 2022: the VoIP target class is the constant, this CVE is just the current door.