filestore - RCE (CVE-2025-64328)
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
psychologyCrowdSec Analysis
CVE-2025-64328 is a command injection vulnerability in the filestore module of FreePBX Endpoint Manager, affecting versions 17.0.2.36 and above before 17.0.3. Authenticated users can exploit this flaw via the testconnection feature to execute arbitrary commands as the asterisk user, potentially gaining remote access to the system. This vulnerability poses a significant risk of remote code execution and privilege escalation within affected FreePBX deployments.
CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-64328 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /admin/ajax.php endpoint with the module=filestore&command=testconnection parameters, injecting commands via the key parameter to achieve remote code execution as the asterisk user. This attack requires authentication and targets the SSH driver functionality in FreePBX Endpoint Manager.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-11-07 |
| CISA KEV | 2026-02-03 |
| CISA Remediation Deadline | 2026-02-24 |
| Rule Released | 2026-03-30 |
| CrowdSec First Seen | 2026-04-02 |
Remediation & Protection
External References
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64328
- https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw
- https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64328.yaml