CVE-2025-64328βSangoma FreePBX OS Command Injection Vulnerability
PUBLISHEDvulnerability record
2026-02-03 Β· last modified February 3, 2026
Metadata
Vulnerability Name
Sangoma FreePBX OS Command Injection Vulnerability
Description
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.
Known To Be Used in Ransomware Campaigns?
Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.