Freepbx Linux 7 vulnerabilities

2 known vulnerabilities in Freepbx Linux 7 from Sangoma. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  freepbx_linux_7: Use of Hard-coded Credentials

  CVE-2023-26566May 14, 2024Sangoma

  Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure Asterisk and make external and internal calls via HTTP and WebSocket requests sent to the API.

• 8.1 High severity

  Freepbx Linux 7: Insufficiently Protected Credentials

  CVE-2023-26567Apr 26, 2023Sangoma

  Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk