Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated…

Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that allows authenticated users to execute commands through the testconnection -> check_ssh_connect() function. The vulnerability requires post-authentication access but can lead to remote system access as the asterisk user. This affects the FreePBX system which is commonly used for VoIP and telephony management. The vulnerability has been assigned CVE-2025-64328 and has security advisories published on GitHub. Organizations using Sangoma FreePBX should review the security advisory and apply necessary patches or mitigations.