CVE-2023-26567

HIGH

Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication cred...

Affects 1 product across 1 vendor.

CVSS 3.18.1
EPSS0.6%
Percentile50th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-522: CWE-522
Related Attack Patterns (CAPEC)
CAPEC-102 Session Sidejacking
via CWE-522
CAPEC-474 Signature Spoofing by Key Theft
via CWE-522
CAPEC-509 Kerberoasting
via CWE-522
CAPEC-551 Modify Existing Service
via CWE-522
CAPEC-561 Windows Admin Shares with Stolen Credentials
via CWE-522
Show all 13

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Sangoma FreePBX versions 1805 through 2302, when obtained as a .ISO file, expose cleartext authentication credentials for the Asterisk Database and Asterisk Manager Interface through global variables, posing a significant security risk.

BSID: BS-2023-GLOBAL-059623-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-26567?
Sangoma FreePBX versions 1805 through 2302, when obtained as a .ISO file, expose cleartext authentication credentials for the Asterisk Database and Asterisk Manager Interface through global variables, posing a significant security risk.
What is the CVSS score for CVE-2023-26567?
CVE-2023-26567 has CVSS 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS: 0.6%.
Is CVE-2023-26567 actively exploited?
No confirmed active exploitation of CVE-2023-26567 as of 2026-05-30.
How do I remediate CVE-2023-26567?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-26567?
CVE-2023-26567 affects Sangoma Freepbx Linux 7.
Vulnerability Details
CVE IDCVE-2023-26567
BSIDBS-2023-GLOBAL-059623-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published2023-04-26
Last Modified2025-02-03
ICS Relevance0%
Weakness (CWE)
CWE-522
SourceNVD
Official Description

Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk Manager Interface. For example, an attacker can make a /ari/asterisk/variable?variable=AMPDBPASS API call.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by making an API call to retrieve the exposed credentials, which can then be used to gain unauthorized access to the Asterisk Database and Manager Interface.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Sangoma Freepbx Linux 7 1805 1904 1910 2002 2008 2011
+8 more2104 2105 2109 2112 2201 2202 2203 2302
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1268 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash35989070286e44ba105cc9c62725478ce0f9dcac8653c5a88b420fb973bbdb83380bd64cf14723cf2e093bdba447bd8e9be8bb0000c3187c37326f1fff3908e3
Related CVEs affecting Sangoma
CVE-2008-6598 10.0 Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and atta... CVE-2014-7235 10.0 htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording ... CVE-2019-12147 9.8 The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vu... CVE-2017-17430 9.8 Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote... CVE-2019-12148 9.8 The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vu...
View all Sangoma CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →