FreePBX CVE-2025-64328: Exploited Admin Command Injection

What to do

1. Check the filestore module version with fwconsole ma list.
2. Upgrade filestore to 17.0.3 or later (fwconsole ma upgrade filestore), or update all modules.
3. Restrict the Administrator Control Panel to trusted networks with the FreePBX Firewall module or an upstream firewall.
4. Review FreePBX admin users and change every admin password.
5. If the panel was exposed while vulnerable, hunt for EncystPHP and rebuild the system if you find it.

How to check if you are affected or compromised

• Look for UID 0 accounts other than root, especially one named newfpbx: getent passwd | awk -F: '$3==0'.
• Check cron for jobs that download from 45.234.176.202 or write files such as /var/lib/asterisk/bin/zen2, devnull, devnull2 or devnull23.
• Look for unexpected ajax.php or config.php files in new web folders such as /var/www/html/rest_phones/, digium_phones/, fpbxphones/ or freepbx/, plus /var/www/html/admin/modules/freepbx_ha/license.php.
• Check for an attacker SSH key in authorized_keys and for the Endpoint Manager module having been removed.

What happened#

On November 5, 2025, the FreePBX project published GHSA-vm9p-46mv-5xvw. It covers a command injection in the filestore module, which backups use to reach FTP, SSH and cloud targets. The flaw sits in the SSH driver's testconnection path (check_ssh_connect()). Anyone who can log in to the Administrator Control Panel can run shell commands as the asterisk user. The advisory says the bug arrived "around March 2025". The module's tags show filestore 17.0.3 on October 23, 2025, with the commit "Validate and Sanitize the SSH input parameters". The CVE record followed on November 7. It and CISA's entry call the component "Endpoint Manager", but the advisory and the fix are in filestore.

On January 28, 2026, Fortinet FortiGuard Labs reported attacks using this bug since early December 2025 to drop a PHP web shell it named EncystPHP. Fortinet links the activity to INJ3CTOR3, a group first seen in 2020 exploiting FreePBX bug CVE-2019-19006. The dropper deletes rival web shells and several FreePBX user accounts, then adds a root-level user named newfpbx and an SSH key. It copies the shell, disguised as ajax.php, into more than ten web paths and plants cron jobs that re-download it every few minutes. CISA added the CVE to the KEV catalog on February 3, 2026. On February 24, Shadowserver said more than 900 IPs were still running web shells, about 400 of them in the US, according to Security Affairs.

Who is affected#

FreePBX 17 systems with filestore 17.0.2.36 through 17.0.2.44. FreePBX 16 is outside the advisory's range. NVD scores the bug 7.2; the advisory gives 8.6 under CVSS 4.0. Both scores reflect the need for an admin login.

Do you really need to act?#

If your admin panel faces the internet, yes. Fortinet does not say how attackers got admin access. Weak or reused passwords are one route. Earlier FreePBX authentication flaws are another: CVE-2025-57819 (in KEV since August 2025) and CVE-2019-19006, which CISA added the same day as this one. A patched module does not remove a web shell already in place, so check any box that was exposed during the window.

What to do now#

1. Check the version: fwconsole ma list | grep -i filestore.
2. Upgrade: fwconsole ma upgrade filestore (or fwconsole ma updateall), then fwconsole reload. The current release is 17.0.3.2.
3. Restrict the Administrator Control Panel to trusted addresses with the FreePBX Firewall module or a perimeter firewall, as the advisory recommends.
4. Review admin users with mysql asterisk -e "SELECT username FROM ampusers;" and change every admin password.
5. If you find compromise, rebuild from a known-good backup. EncystPHP sets several persistence mechanisms, and Fortinet says it fakes its own removal.

How to tell if you were hit#

Run getent passwd | awk -F: '$3==0'. Anything besides root, especially newfpbx, is a red flag. Check crontab -l -u asterisk and /etc/cron* for downloads from 45.234.176.202 or writes to /var/lib/asterisk/bin/zen2, devnull, devnull2 or devnull23. Look for directories such as /var/www/html/rest_phones/, digium_phones/, fpbxphones/, freepbxphones/ and freepbx/, and for /var/www/html/admin/modules/freepbx_ha/license.php, /var/www/html/admin/views/.htaccess and /var/spool/asterisk/tmp/serv. Review authorized_keys files and confirm the Endpoint Manager module still exists, since the dropper deletes it.

Timeline#

• Oct 23, 2025 — filestore 17.0.3 is tagged with the SSH input fix.
• Nov 5, 2025 — FreePBX publishes the advisory. The CVE follows on November 7.
• Dec 2025 — Exploitation begins in early December, according to Fortinet.
• Jan 28, 2026 — Fortinet publishes its EncystPHP analysis.
• Feb 3, 2026 — CISA adds CVE-2025-64328 to KEV, with a February 24 deadline for federal agencies.
• Feb 24, 2026 — Shadowserver reports more than 900 FreePBX IPs still running web shells.

Vulnerability records

• CVE-2025-64328 · KEV 2026-02-03 · FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. FreePBX — GHSA-vm9p-46mv-5xvw: Authenticated Command Injection in FreePBX Administration GUI github.com
2. CVE record — CVE-2025-64328 cve.org
3. NVD — CVE-2025-64328 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-64328 cisa.gov
5. FreePBX — filestore module release tags github.com
6. Fortinet FortiGuard Labs — Unveiling the weaponized web shell EncystPHP fortinet.com

Coverage and analysis

1. Security Affairs — CVE-2025-64328 exploitation impacts 900 Sangoma FreePBX instances securityaffairs.com