This critical vulnerability in the Sangoma FreePBX filestore module is currently being actively exploited in the wild, posing a severe risk of remote code execution.

The vulnerability is an OS Command Injection (CWE-78) located within the administrative interface of the filestore module. It is triggered by an authenticated user via the check_ssh_connect() function, which fails to properly neutralize special characters, allowing an attacker to gain access as an asterisk user.

The exploitation of this flaw allows an attacker to achieve remote code execution on the underlying telephony system. With a CVSS score of 9.5, this vulnerability represents a critical risk that could lead to full system compromise, unauthorized data access, and the potential disruption of critical business communication services.

Immediate Action: Update the FreePBX filestore module to version 17.0.3 or higher immediately to apply the vendor-provided security fix.

Proactive Monitoring: Review system logs for unusual process execution patterns or suspicious SSH connection attempts originating from the administrative interface.

Compensating Controls: Restrict access to the FreePBX administrative interface to authorized IP addresses only and ensure that user accounts are managed with the principle of least privilege.

Public Exploit Available: Yes: A Metasploit module and Nuclei templates are available.

Due to the critical severity and confirmed active exploitation in the wild, organizations must treat this vulnerability with the highest level of urgency. Applying the patch to version 17.0.3 is the only effective way to remediate this command injection flaw. Security teams should ensure that all administrative interfaces for FreePBX are isolated from public exposure while updates are being deployed.