Security readout for executives and security teams
Plain-English summary
A flaw in the FreePBX phone-system admin interface lets a logged-in administrator trick the server into running attacker-chosen commands. Because FreePBX runs critical telephony, a compromise can disrupt calls, expose recordings, and give intruders a foothold inside the network. The vendor has released version 17.0.3 to fix it.
Executive priority
Treat as a high-priority patch for any organization running FreePBX. Even though the attacker must already be authenticated, telephony systems are attractive targets for toll fraud, eavesdropping, and lateral movement, so plan an out-of-cycle update if exposure is confirmed.
Technical view
CVE-2025-64328 is an authenticated OS command injection (CWE-78) in the FreePBX Endpoint Manager filestore module, specifically the SSH driver's testconnection / check_ssh_connect() path. Unsanitized input passed to a shell context lets an authenticated admin execute arbitrary commands as the asterisk user. Affected versions are 17.0.2.36 up to but not including 17.0.3. CVSS 4.0 base score 8.6.
Likely exposure
FreePBX systems running Endpoint Manager filestore module versions 17.0.2.36 through 17.0.2.x with the admin GUI reachable by authenticated users. Internet-exposed admin portals materially increase exposure; segmented or VPN-gated portals reduce it. Anyone with valid admin credentials, including stale or shared accounts, can trigger the flaw.
Exploitation context
Per the CVE record and GitHub advisory GHSA-vm9p-46mv-5xvw, exploitation requires prior authentication as a known administrative user. The CVE bundle indicates KEV=false, so no confirmed CISA Known Exploited Vulnerabilities listing is asserted in the source data. Sangoma/FreePBX has discussed active scrutiny of filestore-related issues in their security communications.
Researcher notes
Vulnerable code path is drivers/SSH/testconnection.php in the FreePBX filestore repository, called via check_ssh_connect(). Look for shell metacharacter handling around SSH connection parameters. Privilege gained is the asterisk service account, which typically has broad access to call data, configuration, and system binaries on a FreePBX host. CVSS 4.0 vector indicates network attack, low complexity, high privileges required, no user interaction, with high confidentiality, integrity, and availability impact.
Mitigation direction
- Upgrade FreePBX Endpoint Manager filestore module to version 17.0.3 or later per vendor advisory.
- Restrict the FreePBX Administration GUI to trusted management networks or VPN only.
- Enforce unique, strong credentials and MFA for every FreePBX admin account; disable unused accounts.
- Audit and rotate any administrator credentials that may have been exposed or shared.
- Monitor the asterisk user for unexpected child processes, outbound connections, or new web shells.
Validation and detection
- Confirm installed filestore module version is 17.0.3 or higher across all FreePBX nodes.
- Inventory administrator accounts and verify least privilege and MFA where supported.
- Review web server and FreePBX logs for filestore SSH testconnection requests with anomalous parameters.
- Check process and command history for the asterisk user covering the exposure window.
- Verify the admin GUI is not reachable from untrusted networks via external port scan.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-64328 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (4.0)
- Known Exploited
- Yes
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvwCVE reference · x_refsource_CONFIRM
- https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2CVE reference · x_refsource_MISC
- https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80CVE reference · x_refsource_MISC
- https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphpCVE reference · third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64328CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.