[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fR16RucSmoR0wvvWUD_1qhrwn4rQ9wO1Ohmt5dU3UQ64":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":93,"kevVulnerabilities":153,"topProductsByCves":163,"seoMetadata":174,"meta":183},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":92},27837,"sangoma",17,61,2,2459,"2025-09-23","s",[16,22,28,33,38,42,47,51,56,61,66,70,73,77,80,83,88],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},143818,"freepbx",1617,28,"2025-09-15",{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":27,"last_cve_update":13},143815,"asterisk",216,21,0,{"id":29,"product_name":30,"version_count":31,"cve_count":32,"kev_count":27,"last_cve_update":13},143816,"certified_asterisk",5,9,{"id":34,"product_name":35,"version_count":36,"cve_count":11,"kev_count":27,"last_cve_update":37},143830,"voicemail",340,"2022-12-27",{"id":39,"product_name":40,"version_count":27,"cve_count":11,"kev_count":27,"last_cve_update":41},143826,"session_border_controller","2019-10-22",{"id":43,"product_name":44,"version_count":45,"cve_count":11,"kev_count":27,"last_cve_update":46},143825,"restapps",10,"2021-12-22",{"id":48,"product_name":49,"version_count":50,"cve_count":11,"kev_count":27,"last_cve_update":41},143827,"session_border_controller_firmware",4,{"id":52,"product_name":53,"version_count":54,"cve_count":54,"kev_count":27,"last_cve_update":55},143829,"switchvox",1,"2022-02-14",{"id":57,"product_name":58,"version_count":59,"cve_count":54,"kev_count":27,"last_cve_update":60},143831,"wanpipe",7,"2009-04-03",{"id":62,"product_name":63,"version_count":64,"cve_count":54,"kev_count":27,"last_cve_update":65},143819,"freepbx_linux_7",14,"2023-04-26",{"id":67,"product_name":68,"version_count":27,"cve_count":54,"kev_count":27,"last_cve_update":69},143820,"img2020","2025-06-03",{"id":71,"product_name":72,"version_count":27,"cve_count":54,"kev_count":27,"last_cve_update":69},143821,"img2020_firmware",{"id":74,"product_name":75,"version_count":27,"cve_count":54,"kev_count":27,"last_cve_update":76},143822,"netborder\\\u002Fvega_session","2017-12-07",{"id":78,"product_name":79,"version_count":54,"cve_count":54,"kev_count":27,"last_cve_update":76},143823,"netborder\\\u002Fvega_session_firmware",{"id":81,"product_name":82,"version_count":27,"cve_count":54,"kev_count":27,"last_cve_update":46},143824,"pbxact",{"id":84,"product_name":85,"version_count":86,"cve_count":27,"kev_count":27,"last_cve_update":87},143828,"superfecta",105,null,{"id":89,"product_name":90,"version_count":91,"cve_count":27,"kev_count":27,"last_cve_update":87},143817,"filestore",139,"Sangoma is a technology vendor with 17 tracked products and 61 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[94,102,111,116,121,126,131,135,142,148],{"cveId":95,"description":96,"publishedDate":97,"cvssScore":98,"cvssVersion":99,"severity":100,"isKev":4,"epssScore":101},"CVE-2025-57819","FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.","2025-08-28",9.8,"v3.1","Critical",0.95024,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":106,"cvssVersion":107,"severity":108,"isKev":109,"epssScore":110},"CVE-2012-4869","The callme_startcall function in recordings\u002Fmisc\u002Fcallme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action.","2012-09-06",7.5,"v2","High",false,0.70252,{"cveId":112,"description":113,"publishedDate":114,"cvssScore":98,"cvssVersion":99,"severity":100,"isKev":4,"epssScore":115},"CVE-2019-19006","Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.","2019-11-21",0.55946,{"cveId":117,"description":118,"publishedDate":119,"cvssScore":106,"cvssVersion":107,"severity":108,"isKev":109,"epssScore":120},"CVE-2014-1903","admin\u002Flibraries\u002Fview.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin\u002Fconfig.php.","2014-02-18",0.5181,{"cveId":122,"description":123,"publishedDate":124,"cvssScore":106,"cvssVersion":99,"severity":108,"isKev":109,"epssScore":125},"CVE-2023-49294","Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.","2023-12-14",0.45293,{"cveId":127,"description":128,"publishedDate":129,"cvssScore":45,"cvssVersion":107,"severity":100,"isKev":109,"epssScore":130},"CVE-2014-7235","htdocs_ari\u002Fincludes\u002Flogin.php in the ARI Framework module\u002FAsterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.","2014-10-07",0.43262,{"cveId":132,"description":133,"publishedDate":46,"cvssScore":98,"cvssVersion":99,"severity":100,"isKev":109,"epssScore":134},"CVE-2021-45461","FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.",0.21492,{"cveId":136,"description":137,"publishedDate":138,"cvssScore":139,"cvssVersion":107,"severity":140,"isKev":109,"epssScore":141},"CVE-2010-3490","Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. (dot dot) in the usersnum parameter to admin\u002Fconfig.php, as demonstrated by creating a .php file under the web root.","2010-09-28",6.5,"Medium",0.09388,{"cveId":143,"description":144,"publishedDate":145,"cvssScore":139,"cvssVersion":146,"severity":140,"isKev":109,"epssScore":147},"CVE-2018-12228","An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP\u002FTLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusable.","2018-06-12","v3.0",0.06698,{"cveId":149,"description":150,"publishedDate":124,"cvssScore":151,"cvssVersion":99,"severity":140,"isKev":109,"epssScore":152},"CVE-2023-49786","Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to a DoS due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a1872804321302ef93bf62cba05 contains a fix, which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6.",5.9,0.05295,[154,159],{"cveId":112,"description":113,"publishedDate":114,"cvssScore":98,"cvssVersion":99,"severity":100,"isKev":4,"epssScore":115,"cisaVulnName":155,"cisaDateAdded":156,"cisaShortDescription":157,"cisaRequiredAction":158},"Sangoma FreePBX Improper Authentication Vulnerability","2026-02-03","Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":95,"description":96,"publishedDate":97,"cvssScore":98,"cvssVersion":99,"severity":100,"isKev":4,"epssScore":101,"cisaVulnName":160,"cisaDateAdded":161,"cisaShortDescription":162,"cisaRequiredAction":158},"Sangoma FreePBX Authentication Bypass Vulnerability","2025-08-29","Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.",[164,165,166,167,168,169,170,171,172,173],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":27,"last_cve_update":13},{"id":29,"product_name":30,"version_count":31,"cve_count":32,"kev_count":27,"last_cve_update":13},{"id":34,"product_name":35,"version_count":36,"cve_count":11,"kev_count":27,"last_cve_update":37},{"id":39,"product_name":40,"version_count":27,"cve_count":11,"kev_count":27,"last_cve_update":41},{"id":43,"product_name":44,"version_count":45,"cve_count":11,"kev_count":27,"last_cve_update":46},{"id":48,"product_name":49,"version_count":50,"cve_count":11,"kev_count":27,"last_cve_update":41},{"id":52,"product_name":53,"version_count":54,"cve_count":54,"kev_count":27,"last_cve_update":55},{"id":57,"product_name":58,"version_count":59,"cve_count":54,"kev_count":27,"last_cve_update":60},{"id":62,"product_name":63,"version_count":64,"cve_count":54,"kev_count":27,"last_cve_update":65},{"title":175,"metaDescription":176,"keywords":177,"structuredData":178},"Sangoma - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Sangoma covering 17 products with 61 tracked vulnerabilities including 2 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Sangoma vulnerabilities, Sangoma security, Sangoma CVE, Sangoma threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Sangoma KEV, Sangoma exploited vulnerabilities",{"@context":179,"@type":180,"name":181,"description":176,"url":182},"https:\u002F\u002Fschema.org","Organization","Sangoma","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fsangoma",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":184,"apiVersion":185},"2026-10-19T18:44:26.157Z","3.0"]