CVE-2025-64328: FreePBX Endpoint Manager filestore module OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows authenticated remote command injection with high impact, is listed in CISA KEV, and has a very high EPSS score indicating active exploitation.

What it is

The filestore module in FreePBX Endpoint Manager (versions 17.0.2.36 and above before 17.0.3) contains an OS command injection reachable through the Administrative interface's testconnection -> check_ssh_connect() function. An authenticated user with known credentials can inject commands and gain remote access to the system as the asterisk user. It is fixed in version 17.0.3.

Impact

An attacker with valid credentials gains remote code execution on the FreePBX host under the asterisk user, enabling further compromise of the telephony system.

Attack surface

Reached over the network through the Administrative web interface; the CVSS vector indicates network attack with high privileges required and no user interaction. Authentication as a known user is required before exploitation.

Exploitation

CVE-2025-64328 is listed in CISA KEV with a 30-day EPSS probability of 0.84618 (99.7th percentile), and a reference is tagged Exploit, indicating active exploitation in the wild. No ransomware campaign use is documented.

What to do

• Upgrade FreePBX Endpoint Manager to version 17.0.3 or later.
• Apply the vendor mitigation guidance in the GHSA-vm9p-46mv-5xvw advisory if immediate patching is not possible.
• Restrict Administrative interface access to trusted networks and remove or disable unused accounts.
• Rotate credentials for any account with access to the filestore module and review for unauthorized changes.
• Follow CISA BOD 22-01 required actions for cloud services or discontinue use if mitigations are unavailable.

Detection

• Review FreePBX/web server logs for requests to the filestore testconnection endpoint containing shell metacharacters or unexpected command strings.
• Monitor for processes spawned by the web server or asterisk user that are inconsistent with normal telephony operations.
• Hunt for web shells or unexpected files on the FreePBX host, referencing the Fortinet report on the EncystPHP web shell.
• Audit authentication logs for use of known accounts accessing the filestore Administrative interface outside normal patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.