CVE-2025-64328

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

• CWE-78

• https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2Product
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvwVendor Advisory, Mitigation
• https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64328Third Party Advisory, US Government Resource
• https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphpExploit, Third Party Advisory

Published

Nov 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64322Incorrect Permission Assignment for Critical Resource vulner…5.3
• CVE-2025-64323kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.…5.3
• CVE-2025-64324KubeVirt is a virtual machine management add-on for Kubernet…7.7
• CVE-2025-64325Emby Server is a personal media server. Prior to version 4.8…9
• CVE-2025-64326Weblate is a web based localization tool. In versions 5.14 a…3.5
• CVE-2025-64327ThinkDashboard is a self-hosted bookmark dashboard built wit…5.3
• CVE-2025-64329containerd is an open-source container runtime. Versions 1.7…5.5
• CVE-2025-6433If a user visited a webpage with an invalid TLS certificate,…9.8
• CVE-2025-64330Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64331Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64332Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64333Suricata is a network IDS, IPS and NSM engine developed by t…7.5