CVE-2025-64328: high-severity vulnerability in FreePBX filestore
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
FreePBX Endpoint Manager allows authenticated users to inject commands through the SSH connection test feature, potentially giving them control of the system. This is dangerous because an insider or compromised account could take over the entire phone system.
The testconnection function in the filestore module fails to properly sanitize user input before passing it to shell commands (CWE-78). An authenticated attacker with access to the Administrative GUI can inject arbitrary OS commands via the check_ssh_connect() function, executing them as the asterisk user. This requires valid credentials but allows unauthenticated remote code execution on the underlying system.
The full analysis of this CVE is available in Portuguese →