CASCACascade Atlas

Evidence dossier

CVE-2025-64328

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

76.4–94.9Priority evidence range
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

State
PUBLISHED
Published
Nov 7, 2025
Updated
Feb 13, 2026
Evidence coverage
72%
CISA KEVCatalog member

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

FIRST EPSS84.62%

2026-07-18 · v2026.06.15 · percentile 99.7%

Source stateConflict visible

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment
container

CISA ADP Vulnrichment

GitHub_Moriginal assertion
container

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

CISA KEVoriginal assertion
observed_exploitation

Sangoma FreePBX OS Command Injection Vulnerability

FIRST EPSSoriginal assertion
model_probability

Probability 0.846180000000; percentile 0.996780000000

Applicability

Cited product scope

Trace impact →
FreePBXfilestore
[{"status": "affected", "version": ">= 17.0.2.36, < 17.0.3"}]unknown
Unknown vendorUnknown product
cpe:2.3:a:sangoma:filestore:*:*:*:*:*:freepbx:*:*; start including 17.0.2.36; end excluding 17.0.3supported

Assessments

CVSS by origin

7.2
nvd@nist.govCVSS 3.1 · role PrimaryCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
8.6
security-advisories@github.comCVSS 4.0 · role SecondaryCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
8.6
GitHub_MCVSS 4.0 · role unknownCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Limitations and unknowns

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown.
  • NVD-carried upstream facts remain derivative and are not independent corroboration.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Factor D is unknown in Public Core because no accepted canonical mapping-obligation ledger is present.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.