Read the docs
TI-2023-11701 Aliases CVE-2023-26567GHSA-356c-rcq8-p23g

Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER…

Priority LOW 38CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-522.

Summary

Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk Manager Interface. For example, an attacker can make a /ari/asterisk/variable?variable=AMPDBPASS API call.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00649 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:freepbx_linux_7:1805:*:*:*:*:*:*:*1805VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:1904:*:*:*:*:*:*:*1904VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:1910:*:*:*:*:*:*:*1910VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2002:*:*:*:*:*:*:*2002VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2008:*:*:*:*:*:*:*2008VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2011:*:*:*:*:*:*:*2011VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2104:*:*:*:*:*:*:*2104VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2105:*:*:*:*:*:*:*2105VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2109:*:*:*:*:*:*:*2109VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2112:*:*:*:*:*:*:*2112VulnerableSangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:1805:*:*:*:*:*:*:* Versions 1805 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:1904:*:*:*:*:*:*:* Versions 1904 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:1910:*:*:*:*:*:*:* Versions 1910 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2002:*:*:*:*:*:*:* Versions 2002 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2008:*:*:*:*:*:*:* Versions 2008 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2011:*:*:*:*:*:*:* Versions 2011 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2104:*:*:*:*:*:*:* Versions 2104 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2105:*:*:*:*:*:*:* Versions 2105 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2109:*:*:*:*:*:*:* Versions 2109 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2112:*:*:*:*:*:*:* Versions 2112 Vulnerable ·Sangoma
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sangoma:freepbx_linux_7:2201:*:*:*:*:*:*:*2201VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2202:*:*:*:*:*:*:*2202VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2203:*:*:*:*:*:*:*2203VulnerableSangoma
cpe:2.3:a:sangoma:freepbx_linux_7:2302:*:*:*:*:*:*:*2302VulnerableSangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2201:*:*:*:*:*:*:* Versions 2201 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2202:*:*:*:*:*:*:* Versions 2202 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2203:*:*:*:*:*:*:* Versions 2203 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:freepbx_linux_7:2302:*:*:*:*:*:*:* Versions 2302 Vulnerable ·Sangoma

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26567
  2. 2026-10-03 Alias added: GHSA-356c-rcq8-p23g
  3. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences