# CVE-2025-64328: filestore - RCE

> Live exploitation tracking for CVE-2025-64328 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-64328

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.6
- **Public exploit available:** Yes
- **Affected products:** Sangoma filestore
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** management_panel

## Description

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

## CrowdSec analysis

[CVE-2025-64328](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-64328) is a command injection vulnerability in the filestore module of FreePBX Endpoint Manager, affecting versions 17.0.2.36 and above before 17.0.3. Authenticated users can exploit this flaw via the testconnection feature to execute arbitrary commands as the asterisk user, potentially gaining remote access to the system. This vulnerability poses a significant risk of remote code execution and privilege escalation within affected FreePBX deployments.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-64328 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/admin/ajax.php` endpoint with the `module=filestore&command=testconnection` parameters, injecting commands via the `key` parameter to achieve remote code execution as the asterisk user. This attack requires authentication and targets the SSH driver functionality in FreePBX Endpoint Manager.

## Timeline

- 2025-11-07: CVE Published. CVE-2025-64328 is published to NVD.
- 2026-02-03: CISA KEV. CVE-2025-64328 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-02-24: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-03-30: Rule Released. CrowdSec releases a rule to detect CVE-2025-64328 exploitation attempts against the CrowdSec Network.
- 2026-04-02: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-64328 for the first time.

## References

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64328
- https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw
- https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64328.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-64328) follows observed exploitation activity for CVE-2025-64328. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.