CVE-2025-64328: listed in the CISA KEV catalog

CVE-2025-64328 · CVSS 7.2 HIGH · EPSS 85% · KEV 2026-02-03

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

Is CVE-2025-64328 exploited?

• Listed in the CISA KEV catalog on 2026-02-03.
• Federal remediation due 2026-02-24.
• Past that date by 172 days.
• EPSS puts exploitation in the next 30 days at 85%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2025-64328

• Metasploit Framework 6.4.123 Adds Two Exploits (2026-03-21)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/unix/http/freepbx_filestore_cmd_injection
• Nuclei template

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.