FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
Only affects the FreePBX 17 filestore module from 17.0.2.36 before 17.0.3, where any user with access to the Administration panel can run shell commands. Fixed in 17.0.3.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 17.0.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FreePBX, a telephone system administration platform, is affected through its Administration GUI's filestore module. An authenticated user can inject commands, potentially gaining remote access to the system as the asterisk user.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- FreePBX filestore
From 17.0.2.36 · fixed in 17.0.3
References 3
GitHub · FreePBX/security-reporting
GitHub · FreePBX/filestore
freepbx.org
Questions about CVE-2025-64328
What does this mean?
A user who already has access to the FreePBX Administration panel can run arbitrary shell commands on the underlying host. This gives them remote access as the asterisk user.Source: github.com
Am I affected, and how do I check?
The filestore module from 17.0.2.36 up to, but not including, 17.0.3 is affected. Check the installed filestore module version in the FreePBX Administration panel to see which version is in use.Source: github.com
What should I do about it?
Upgrade the filestore module to 17.0.3 or later. Until then, limit Administration panel access to authorized users only.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-02-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data