The Shadowserver Basis has revealed that over 900 Sangoma FreePBX cases nonetheless stay contaminated with net shells as a part of assaults that exploited a command injection vulnerability beginning in December 2025.
Of those, 401 cases are positioned within the U.S., adopted by 51 in Brazil, 43 in Canada, 40 in Germany, and 36 in France.
The non-profit entity stated the compromises are possible achieved by way of the exploitation of CVE-2025-64328 (CVSS rating: 8.6), a high-severity safety flaw that would allow post-authentication command injection.
“The affect is that any consumer with entry to the FreePBX Administration panel may leverage this vulnerability to execute arbitrary shell instructions on the underlying host,” FreePBX stated in an advisory for the flaw in November 2025. “An attacker may leverage this to acquire distant entry to the system because the asterisk consumer.”
The vulnerability impacts FreePBX variations larger than and together with 17.0.2.36. It was resolved in model 17.0.3. As mitigations, it is suggested so as to add safety controls to make sure that solely licensed customers have entry to the FreePBX Administrator Management Panel (ACP), limit entry from hostile networks to the ACP, and replace the filestore module to the most recent model.
The vulnerability has since come beneath lively exploitation within the wild, prompting the U.S. Cybersecurity and Infrastructure Safety Company (CISA) to add it to its Recognized Exploited Vulnerabilities (KEV) catalog earlier this month.
 |
| Supply: The Shadowserver Basis |
In a report revealed late final month, Fortinet FortiGuard Labs revealed that the menace actor behind the cyber fraud operation codenamed INJ3CTOR3 has been exploiting CVE-2025-64328 beginning early December 2025 to ship an online shell codenamed EncystPHP.
“By leveraging Elastix and FreePBX administrative contexts, the online shell operates with elevated privileges, enabling arbitrary command execution on the compromised host and initiating outbound name exercise by means of the PBX atmosphere,” the cybersecurity firm famous.
FreePBX customers are really helpful to replace their FreePBX deployments to the most recent model as quickly as attainable to counter lively threats.
