OS Command Injection in Sangoma FreePBX Endpoint Manager (CVE-2025-64328)

Historical catalog analysis: CISA added this entry on February 03, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-64328 is an OS command injection vulnerability (CWE-78) located within the Sangoma FreePBX Endpoint Manager. The flaw exists in the testconnection -> check_ssh_connect() function. If exploited, this vulnerability could allow a known, authenticated user to execute arbitrary operating system commands, potentially resulting in remote access to the underlying system with the privileges of the asterisk user.

Exposure and applicability

This vulnerability applies specifically to deployments utilizing the Sangoma FreePBX Endpoint Manager. Because the exploit requires post-authentication, the primary exposure path is through accounts already possessing valid credentials for the system. Organizations managing VoIP infrastructure that employ this specific module should prioritize identifying whether their current version is susceptible.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities (KEV) catalog, remediation should be treated as a high priority. Our analysis suggests the following prioritized actions:

1. Apply Vendor Mitigations: The primary corrective action is to apply the mitigations provided by Sangoma. This addresses the root cause within the check_ssh_connect() function.
2. Evaluate Product Necessity: In environments where vendor mitigations cannot be applied or verified, organizations should evaluate whether to discontinue use of the Endpoint Manager module to eliminate the attack surface entirely.
3. Credential Audit: Since this is a post-authentication flaw, reviewing and limiting the number of users with administrative access to the FreePBX interface could reduce the pool of potential internal attackers or compromised accounts that could leverage this injection point.

How to validate remediation

Verification must go beyond confirming a version number or the presence of a patch. To ensure exposure is actually reduced, defenders should focus on the following:

• Functional Validation: Confirm that the testconnection feature behaves as expected and does not accept unexpected characters or command sequences in its input fields.
• Privilege Verification: Verify that the asterisk user’s permissions are restricted to the minimum necessary for operation, limiting the potential impact if a command injection were to occur.

Limits and open questions

While the entry point is identified as the check_ssh_connect() function, it remains unknown whether this vulnerability has been used in specific ransomware campaigns. Additionally, while CISA has mandated a remediation deadline for federal agencies (2026-02-24), this date serves as a risk indicator rather than a technical requirement for non-federal entities. Residual risk remains if authenticated users maintain excessive privileges that allow them to pivot from the asterisk user account to higher system levels.

Source and editorial note

CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability · Source date: February 03, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 06, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 22, 2026 at 00:16 UTC.

Request a Vulnerability Assessment