CVE-2025-64328: Sangoma Firestore RCE Vulnerability

CVE-2025-64328 Overview

CVE-2025-64328 is a critical post-authentication command injection vulnerability affecting FreePBX Endpoint Manager, a module used for managing telephony endpoints in FreePBX systems. The vulnerability exists in versions 17.0.2.36 and above before 17.0.3, specifically within the filestore module's administrative interface. An authenticated user can exploit the vulnerable testconnection -> check_ssh_connect() function to execute arbitrary commands on the underlying system, gaining remote access as the asterisk user.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can leverage authenticated access to achieve remote code execution, potentially compromising the entire telephony infrastructure.

Affected Products

• Sangoma Firestore versions 17.0.2.36 to 17.0.3 (exclusive)
• FreePBX systems utilizing the vulnerable filestore module
• FreePBX Endpoint Manager deployments with SSH test connection functionality enabled

Discovery Timeline

• 2025-11-07 - CVE-2025-64328 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-64328

Vulnerability Analysis

This vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command (Command Injection). The flaw resides in the SSH test connection functionality within the FreePBX filestore module's administrative interface. When an authenticated administrator attempts to verify SSH connectivity, user-supplied input is passed to the check_ssh_connect() function without adequate sanitization. This allows an attacker with valid credentials to inject arbitrary operating system commands that execute with the privileges of the asterisk user account.

The network-based attack vector means exploitation can occur remotely against any exposed FreePBX administrative interface. While elevated privileges (administrative authentication) are required, the attack complexity is low and requires no user interaction. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is insufficient input validation and sanitization in the testconnection.php file's check_ssh_connect() function. User-controlled parameters intended for SSH connection testing are concatenated directly into shell commands without proper escaping or validation. This design flaw allows specially crafted input containing shell metacharacters to break out of the intended command context and execute arbitrary commands on the host operating system.

Attack Vector

The attack requires an authenticated session to the FreePBX administrative interface. Once authenticated, an attacker navigates to the filestore module and initiates an SSH connection test. By manipulating the connection parameters with shell metacharacters and command sequences, the attacker can inject malicious commands. These commands execute in the context of the asterisk user, which typically has significant access to the telephony system and underlying operating system resources.

The exploitation chain typically involves:

1. Obtaining or leveraging valid administrative credentials
2. Accessing the filestore module's SSH test connection interface
3. Injecting shell commands via the connection test parameters
4. Achieving command execution as the asterisk user
5. Potentially deploying web shells or establishing persistent access

For detailed technical analysis, refer to the GitHub Security Advisory GHSA-vm9p-46mv-5xvw and the vulnerable code in testconnection.php.

Detection Methods for CVE-2025-64328

Indicators of Compromise

• Unexpected processes spawned by the asterisk user, particularly shell interpreters or network utilities
• Web shell files appearing in FreePBX web directories
• Anomalous SSH connection test requests with special characters in the administrative logs
• Outbound network connections from the FreePBX server to unknown external hosts
• Modifications to system files or cron jobs under the asterisk user context

Detection Strategies

• Monitor FreePBX administrative logs for suspicious SSH connection test activity with unusual parameter values
• Implement file integrity monitoring on FreePBX web directories to detect web shell deployment
• Deploy network intrusion detection signatures for command injection patterns targeting the filestore module
• Audit process creation events for shell commands spawned by the Apache/PHP or asterisk user accounts

Monitoring Recommendations

• Enable verbose logging for the FreePBX administrative interface and filestore module
• Configure SIEM alerts for command injection indicators such as shell metacharacters in HTTP POST parameters
• Monitor for the creation of new files in web-accessible directories by the asterisk user
• Review Fortinet's threat research for additional web shell indicators associated with this exploitation

How to Mitigate CVE-2025-64328

Immediate Actions Required

• Upgrade FreePBX Endpoint Manager to version 17.0.3 or later immediately
• Review administrative access logs for evidence of exploitation
• Restrict network access to the FreePBX administrative interface using firewall rules or VPN requirements
• Audit all administrative user accounts and enforce strong authentication measures
• Scan for web shells and unauthorized modifications in the FreePBX installation directory

Patch Information

Sangoma has released version 17.0.3 of the FreePBX Endpoint Manager which addresses this command injection vulnerability. Organizations should apply this patch as a priority given the vulnerability's inclusion in CISA's Known Exploited Vulnerabilities catalog. Detailed patch information is available in the FreePBX Security Updates Overview and the GitHub Security Advisory.

Workarounds

• Disable the SSH connection test functionality in the filestore module if not operationally required
• Implement network-level access controls to limit administrative interface exposure to trusted IP ranges only
• Deploy a web application firewall (WAF) with rules to detect and block command injection attempts
• Enable multi-factor authentication for all administrative accounts to reduce credential-based attack risk

# Example: Restrict administrative interface access using iptables
# Only allow access from trusted management network
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP