CVE-2025-64328 — Sangoma FreePBX OS Command Injection Vulnerability
CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | Sangoma |
| Product | FreePBX |
| Date added | 2026-02-03 |
| Due date | 2026-02-24 |
| Ransomware campaign use | Unknown |
Description
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.
Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw ; https://nvd.nist.gov/vuln/detail/CVE-2025-64328
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-64328
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog