CVE-2025-64328 — AI Deep Analysis Summary

🚨 **Essence**: A critical **OS Command Injection** flaw in FreePBX Endpoint Manager.…

🛡️ **Root Cause**: **CWE-78** (Improper Neutralization of Special Elements used in an OS Command).…

📦 **Affected Versions**: FreePBX Endpoint Manager versions **17.0.2.36** up to (but not including) **17.0.3**. Specifically impacts the `filestore` module's SSH testing functionality.

💀 **Attacker Capabilities**: Authenticated users can execute commands as the **asterisk** user.…

🔑 **Exploitation Threshold**: **Medium**. It requires **Authentication**. You need valid credentials (e.g., a low-privilege user account) to trigger the injection via the `testconnection` feature.

💥 **Public Exploit**: **Yes**. Proof of Concept (PoC) code is available on GitHub (e.g., `CVE-2025-64328_FreePBX-framework-Command-Injection`) and Nuclei templates exist for automated scanning.

🔍 **Self-Check**: 1. Check your FreePBX version (must be < 17.0.3). 2. Use Nuclei templates (`CVE-2025-64328.yaml`) to scan for the vulnerable endpoint. 3. Verify if the `filestore` module's SSH test feature is enabled.

🩹 **Official Fix**: **Yes**. FreePBX has issued security advisories (GHSA-vm9p-46mv-5xvw). Users should upgrade to **version 17.0.3 or later** to patch the `check_ssh_connect` function.

🚧 **No Patch Workaround**: If you cannot upgrade immediately: 1. **Disable** the `filestore` module if not needed. 2. Restrict access to the FreePBX admin interface via firewall rules. 3.…

⚡ **Urgency**: **HIGH**. Command Injection is a critical severity. Since PoCs are public and it requires only basic auth, immediate patching to v17.0.3+ is strongly recommended to prevent active exploitation.