CVE-2025-64328: OS Command Injection in Sangoma FreePBX Endpoint Manager Allows Authenticated Remote Access
What It Is – Sangoma FreePBX Endpoint Manager contains an OS command injection flaw in the testconnection → check_ssh_connect() routine. An authenticated user can inject arbitrary shell commands, potentially gaining a remote shell as the asterisk system account.
Exploitability – The vulnerability is post‑authentication; an attacker must first have valid FreePBX credentials. Public proof‑of‑concept code has been released, and the CVSS score is 8.8 (High).
Affected Products – Sangoma FreePBX Endpoint Manager (all supported versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw demonstrates how privileged‑account misuse can bypass intended separation of duties, a core control area that underpins many frameworks (e.g., NIST CSF 2.0 PR.AC‑1).
- Continuous evidence – Detecting anomalous command execution requires logging and real‑time monitoring; without verifiable logs, auditors cannot prove that the control was effective.
- Defensible audit trail – Demonstrating that only authorized users can execute system commands is a key piece of audit readiness for any organization that must prove control assurance to customers or regulators.
Recommended Actions
- Patch immediately – Apply Sangoma’s security update that sanitizes the
check_ssh_connect()input. - Enforce least‑privilege – Review user roles in FreePBX; ensure only necessary accounts have access to the test‑connection feature.
- Enable command‑execution logging – Capture and retain shell activity for the
asteriskuser; integrate logs into a SIEM for continuous monitoring. - Validate post‑patch – Run authenticated tests to confirm the injection vector is closed and document the results for audit evidence.
Source: CISA KEV – CVE‑2025‑64328