CVE-2025-64328
HIGH KEV NUCLEIFreePBX 17.0.2.36-17.0.3 - Authenticated OS Command Injection via SSH Connection Test
Title source: llmExploitation Summary
CVE-2025-64328 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 3, 2026.
EIP tracks 2 public exploits from researchers including mcorybillington, Cory Billington, including a Metasploit module exploits/unix/http/freepbx_filestore_cmd_injection.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2025-64328, demonstrating an authenticated command injection vulnerability in the FreePBX framework module. The exploit uses a crafted curl request to inject commands via the 'key' parameter, resulting in arbitrary file creation on the target system.
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
Exploits (2)
This repository contains a proof-of-concept for CVE-2025-64328, demonstrating an authenticated command injection vulnerability in the FreePBX framework module. The exploit uses a crafted curl request to inject commands via the 'key' parameter, resulting in arbitrary file creation on the target system.
This Metasploit module exploits an authenticated command injection vulnerability (CVE-2025-64328) in FreePBX's filestore module. It leverages unsanitized input in the SSH key path parameter to execute arbitrary commands via shell substitution syntax.
Nuclei Templates (1)
http.title:"freepbx" || http.favicon.hash:"-1908328911" || http.favicon.hash:"1574423538" || http.title:"freepbx administration"
icon_hash="-1908328911" || icon_hash="1574423538" || title="freepbx administration" || title="freepbx"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H