FreePBX Endpoint Manager & Filestore Module Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-64328)
Executive & SecOps Summary
SECOPS ASSESSMENTFreePBX Endpoint Manager and Filestore module versions 17.0.2.36 and above before 17.0.3
An authenticated administrator can execute arbitrary OS commands via the SSH connection test function, gaining remote access as the asterisk user
Immediately upgrade the FreePBX Filestore module to version 17.0.3 or higher
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Use the FreePBX CLI utility to update the Filestore module to the patched version (17.0.3 or higher) immediately.
# Update FreePBX module repositories and upgrade the filestore module
fwconsole ma upgrade filestore
# Reload the FreePBX framework to apply changes
fwconsole r2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the FreePBX administration interface (ports 80, 443) using firewall rules to allow only trusted IP addresses.
# Restrict access to the web interface to a trusted administrator IP (e.g., 192.168.1.100)
iptables -A INPUT -p tcp -s 192.168.1.100 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP3. Log Audit & IoC Verification Commands
Verify the currently installed module version and inspect web server logs for suspicious activities targeting the testconnection endpoint.
# Check the currently installed version of the filestore module
fwconsole ma list | grep filestore
# Search for suspicious testconnection requests in web and asterisk logs
grep -ri 'testconnection' /var/log/httpd/ /var/log/asterisk/ 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-64328) is an OS command injection flaw (CWE-78) residing within the Administrative interface of the FreePBX Filestore module. The root cause lies in the testconnection -> check_ssh_connect() function, which is responsible for validating SSH connection parameters. The application fails to properly sanitize or escape user-supplied inputs before passing them to system shell execution functions, allowing command injection.
2. Exploitation Mechanics & Attack Scenario
An attacker must first obtain authenticated access to the FreePBX administrative web interface. By navigating to the Filestore configuration and triggering the SSH connection test (testconnection), the attacker injects malicious shell metacharacters (such as ;, &, or |) followed by arbitrary commands into the connection parameters. The server executes these commands with the privileges of the asterisk system user, enabling the attacker to establish a reverse shell or deploy web shells (e.g., encyst.php).
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation allows full compromise of the PBX system under the asterisk user context. This can lead to severe business impacts, including unauthorized eavesdropping on VoIP communications, toll fraud, lateral movement into the internal corporate network, and sensitive data exfiltration.
Official Vendor Advisories & References
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
Frequently Asked SecOps Questions (CVE-2025-64328)
FAQQ1. How critical is CVE-2025-64328 and is it actively exploited in the wild?
CVE-2025-64328 is rated CVSS 7.2 (HIGH) with a 30-day EPSS exploitation probability of 84.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-64328?
Primary impacted vendors include freepbx across endpoint_manager, filestore. Scope summary: FreePBX Filestore module versions 17.0.2.36 and above before 17.0.3
Q3. What temporary mitigations or workarounds exist for CVE-2025-64328 before patching?
[Mitigation] Immediately upgrade the FreePBX Filestore module to version 17.0.3 or higher Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-64328
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (freepbx)
View Category →LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Critical RCE in Nextcloud Collabora Online Built-in CODE Server (CVE-2026-110447)
[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.
BeyondTrust Remote Support and Privileged Remote Access Pre-Authentication Remote Code Execution (RCE) Vulnerability (CVE-2026-1731) Urgent Security Advisory
[Affected Scope] BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.