CVE-2025-64328

What it actually does

This is a post-authentication command injection in the FreePBX Endpoint Manager administrative filestore functionality. In affected Endpoint Manager versions 17.0.2.36 and later before 17.0.3, user-controlled input reaches the testconnection/check_ssh_connect() SSH connectivity test path without adequate command argument handling, allowing an authenticated user with sufficient administrative access to execute operating-system commands in the context of the asterisk service account. Successful exploitation can provide remote shell access, read or modify PBX configuration and call-routing data, tamper with telephony services, and potentially support further local privilege escalation depending on host hardening.

Why it matters to the business

A compromised FreePBX system can disrupt inbound and outbound calling, voicemail, call queues, contact center operations, emergency communications, and SIP trunking. Because this issue is listed in CISA KEV, has active exploitation reported, and has a high EPSS score, internet-exposed or broadly accessible FreePBX administration interfaces should be treated as urgent remediation targets even though exploitation requires authentication. The supplied package list references Red Hat grub2 packages, which appears inconsistent with the FreePBX Endpoint Manager vulnerability description; organizations should validate asset and vulnerability feed mappings before closing this issue based on unrelated grub2 updates. CISA KEV remediation is due by 2026-02-24 for covered organizations.

How an attack unfolds

An attacker first obtains valid FreePBX administrative or otherwise sufficiently privileged credentials through phishing, password reuse, credential stuffing, prior compromise, or misuse of a known account. The attacker accesses the FreePBX Administrative interface and uses the Endpoint Manager filestore SSH connection test functionality. By supplying crafted input to the SSH connection test workflow, the attacker causes the server-side check_ssh_connect() logic to execute unintended operating-system commands. Those commands run as the asterisk user, allowing the attacker to establish remote access, inspect FreePBX configuration, alter telephony settings, stage tools, add persistence, or pivot to other services reachable from the PBX host. Public reporting and KEV status indicate active in-the-wild exploitation associated with Sangoma FreePBX OS command injection activity, so investigations should assume attempted exploitation where vulnerable administrative interfaces were reachable.

How to fix it

Upgrade FreePBX Endpoint Manager to version 17.0.3 or later. Prioritize systems running Endpoint Manager versions 17.0.2.36 through versions before 17.0.3, especially where the FreePBX Administrative interface is reachable from untrusted networks. Restrict administrative access to trusted management networks or VPN, enforce MFA where supported, remove unused FreePBX accounts, rotate passwords for privileged users, and review role assignments. If immediate upgrade is not possible, disable or remove the Endpoint Manager module, restrict access to the filestore/connection-test functionality, and block direct internet access to the FreePBX admin interface. The provided fixed package list for grub2 version 1:2.02-0.86.el7_7.3 does not align with the described FreePBX Endpoint Manager flaw and should not be considered a sufficient fix for this issue unless separately confirmed by the vendor or distribution advisory.

How to confirm the fix worked

Confirm the installed Endpoint Manager module version from the FreePBX module administration interface or command line and verify it is 17.0.3 or later. Confirm that no affected Endpoint Manager versions from 17.0.2.36 up to but excluding 17.0.3 remain installed. Validate that the FreePBX Administrative interface is not exposed to the public internet and is reachable only from approved management sources. Re-run authenticated vulnerability scanning or configuration assessment after the upgrade. Review web server and FreePBX logs for prior access to Endpoint Manager filestore testconnection functionality before considering the incident closed. If a vulnerability scanner reports this issue against Red Hat grub2 packages, validate the plugin/advisory mapping because that product mapping appears inconsistent with the FreePBX vulnerability details.

Typical attack path

1. Identify an exposed or reachable FreePBX administrative interface with Endpoint Manager installed.
2. Obtain valid credentials for a known FreePBX user with sufficient access to Endpoint Manager administrative functions.
3. Authenticate to the FreePBX Administrative interface.
4. Navigate to or invoke the Endpoint Manager filestore SSH connection test functionality.
5. Submit crafted connection-test input that is processed by testconnection/check_ssh_connect() and triggers command execution.
6. Execute commands as the asterisk service account to establish remote access or run reconnaissance.
7. Modify PBX settings, exfiltrate configuration data, deploy persistence, or attempt local privilege escalation.

How to detect it

Review FreePBX, web server, authentication, process execution, audit, and network telemetry for evidence of authenticated use of Endpoint Manager filestore SSH connection testing followed by unexpected command execution as the asterisk user. Key log sources include FreePBX application logs, Apache/httpd access and error logs, PHP-FPM logs if used, Asterisk logs, Linux authentication logs, auditd process execution logs, EDR telemetry, shell history for service accounts where present, cron/systemd persistence locations, and outbound firewall/proxy/DNS logs. Hunt for POST requests to FreePBX administrative endpoints containing Endpoint Manager, filestore, or testconnection parameters; unusual access to the admin interface from unfamiliar IPs; new or modified FreePBX users; changes to SIP trunks, extensions, routes, or voicemail settings; and child processes spawned by the web server or asterisk service that are not normal for PBX operation, such as shells, download utilities, scripting runtimes, or reverse-connect tools. Since exploitation requires authentication, correlate suspicious Endpoint Manager activity with successful logins, password changes, MFA changes if available, and administrative role changes. For compromised systems, inspect for persistence under cron, systemd units, web-accessible PHP files, modified FreePBX module files, unexpected SSH authorized_keys entries, and outbound connections to rare external hosts shortly after testconnection requests.

• testconnection
• check_ssh_connect
• endpointman
• filestore
• POST /admin/ajax.php
• POST /admin/config.php
• module=endpointman
• display=endpointman
• /var/log/asterisk/freepbx.log
• /var/log/asterisk/full
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/secure
• /var/log/auth.log
• /var/log/audit/audit.log
• /var/www/html/admin/modules/endpointman
• /var/spool/cron/asterisk
• /home/asterisk/.ssh/authorized_keys
• /var/lib/asterisk/.ssh/authorized_keys
• USER=asterisk
• comm="sh"
• comm="bash"
• comm="curl"
• comm="wget"
• comm="nc"
• comm="ncat"
• comm="python"
• comm="perl"
• /etc/systemd/system/
• /etc/cron.d/
• /tmp/
• /var/tmp/

What your security team should do

• Immediately inventory FreePBX systems with Endpoint Manager installed and identify versions 17.0.2.36 through versions before 17.0.3.
• Patch Endpoint Manager to 17.0.3 or later, prioritizing internet-facing or broadly reachable administration interfaces.
• Because this is KEV-listed with active exploitation and high EPSS, treat unpatched exposed systems as likely targeted and perform compromise assessment before or immediately after patching.
• Restrict FreePBX Administrative interface access to VPN or dedicated management networks and block direct public access.
• Audit FreePBX administrative users, remove stale accounts, enforce strong authentication, and rotate credentials for privileged users.
• Search logs for Endpoint Manager filestore testconnection activity, suspicious commands spawned by the asterisk user, unexpected outbound connections, and unauthorized PBX configuration changes.
• If compromise is suspected, preserve logs and disk artifacts, isolate the PBX host as operationally feasible, rotate SIP trunk and admin credentials, and rebuild from trusted media if persistence or privilege escalation is found.
• Validate vulnerability-management data quality where affected products are reported as grub2, because the remediation for this issue is the FreePBX Endpoint Manager update, not unrelated bootloader packages.