CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability

What this vulnerability is in plain English and why it matters. Sangoma FreePBX Endpoint Manager contains an OS command injection flaw that lets an authenticated user run operating-system commands on the server. An attacker who already holds valid credentials can abuse the testconnection feature to gain remote access to the system running as the asterisk user. This matters because FreePBX systems often manage voice infrastructure and sit on internal networks; successful exploitation gives an attacker a foothold that can be used to move laterally or access call data and configuration.

How it works

The weakness is categorized as CWE-78, improper neutralization of special elements used in an OS command. The vulnerability exists in the check_ssh_connect() function called by the testconnection endpoint. An authenticated user supplies input that is concatenated into a system command without sufficient sanitization, allowing the attacker to append additional commands that execute with the privileges of the asterisk account.

Am I affected? How to find it in your systems

Inventory all deployments of Sangoma FreePBX and confirm whether the Endpoint Manager module is installed and enabled. Review administrative accounts and any external exposure of the web interface, because the flaw requires valid credentials. Examine logs for unusual activity around the testconnection endpoint or repeated SSH-related test calls; specific indicators of exploitation must be confirmed against the vendor advisory.

• Locate FreePBX instances by checking standard web ports and the presence of the Asterisk process.
• Query installed modules through the FreePBX administrative interface or package manager to identify Endpoint Manager.
• Review authentication logs and web-server access logs for the affected function paths.

How to remediate

Apply the vendor-supplied update that addresses the command-injection issue in Endpoint Manager. After patching, verify that the testconnection functionality no longer accepts unsanitized input and that administrative access remains restricted to authorized users only.

• Follow the exact upgrade steps published in the vendor advisory.
• Remove or disable any unnecessary administrative accounts.
• Restrict network access to the FreePBX web interface to trusted management networks.

If you can't patch immediately

Until the update can be applied, reduce exposure by limiting network reachability of the management interface and by monitoring for anomalous command execution or new outbound connections from the asterisk user. Apply any virtual-patching rules or web-application firewall signatures supplied by the vendor; if no mitigations are available, discontinue use of the affected module as directed by CISA guidance.

• Segment the FreePBX server so that only required voice and management traffic is permitted.
• Enable detailed logging of web requests and system commands executed by the asterisk account.
• Consider temporary disablement of the Endpoint Manager testconnection feature if the vendor provides that option.

If your data may have been exposed

Actively exploited command-injection vulnerabilities can lead to unauthorized access and data exposure. Review authentication records and system logs for signs of misuse, and confirm the scope of any potential access against the vendor advisory. You can run a free exposure scan of your email addresses to check known breach data.