{"schema":"threatline.record/2","record":{"id":"CVE-2025-64328","aliases":["GHSA-vm9p-46mv-5xvw"],"summary":"Sangoma FreePBX OS Command Injection Vulnerability","details":"Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. ","categories":["Unclassified"],"product":"FreePBX ","vendor":"Sangoma","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-64328","source_modified_at":"2026-02-13T22:08:51.717Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"filestore","vendor":"FreePBX","versions":[{"version":">= 17.0.2.36, < 17.0.3","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":8.6,"severity":"High","kev":{"listed":true,"date_added":"2026-02-03","due_date":"2026-02-24","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.84618,"percentile":0.99707,"score_date":"2026-10-23"},"published_at":"2025-11-07T03:32:20.670Z","modified_at":"2026-02-13T22:08:51.717Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-64328","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-02-13T22:08:51.717Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-11-08"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64328.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64328","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Nuclei","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64328","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64328","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2026-02-03T15:25:17.324538Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"FreePBX filestore authenticated command injection","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb","date":"2025-11-08","added":"2026-03-11","check":true},{"source":"Nuclei","kind":"Scanner template","name":"FreePBX  >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64328.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-02-13T22:08:51.717Z","content_hash":"da5854d7c53c0c9fb56338791f4bec6910e8b534389d1d4db0934f7ff845d7ea"}}