In CISA KEV8.6 HighCWE-78
CVE-2025-64328
Sangoma FreePBX OS Command Injection Vulnerability
SangomaFreePBX
Status
- Exploited in the wild
- In CISA KEV since 3 Feb
- Fixed in version 17.0.3
- Associated threat actor: INJ3CTOR3
Federal deadlineTue 24 Feb, 23:59 UTC
Passed 242 days ago
CISA KEV · added 3 Feb
Exploit probabilityEPSSchecked 25 Oct
85%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
8.6High
Description NVD
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 7 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 27 Feb · 13:27 UTC | SecurityWeek | 900 FreePBX servers hit after CVE-2025-64328 postauth shell |
| Fri 27 Feb · 18:35 UTC | The Hacker News | CVE-2025-64328 fuels 900 FreePBX infections via EncystPHP |
| Sun 1 Mar · 10:46 UTC | Security Affairs | FreePBX CVE-2025-64328 enables postauth commands EncystPHP shells |
| Wed 27 May · 10:32 UTC | SecurityOnline | FreePBX Attackers Deploy JOMANGY Malware for Toll Fraud via CVEs |
- FreePBX Attackers Deploy JOMANGY Malware for Toll Fraud via CVEsSecurityOnline
- FreePBX CVE-2025-64328 enables postauth commands EncystPHP shellsSecurity Affairs
- CVE-2025-64328 fuels 900 FreePBX infections via EncystPHPThe Hacker News
- 900 FreePBX servers hit after CVE-2025-64328 postauth shellSecurityWeek
- Fresh SolarWinds Vulnerability Exploited in AttacksSecurityWeek · mentions it in passing
- U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- Silent Intruder: “EncystPHP” Web Shell Burrows into FreePBX SystemsSecurityOnline · first in our coverage