Sangoma Switchvox SMB Edition is vulnerable to authenticated local file inclusion, which may allow an attacker to read unauthorized files on the target system.

This is a local file inclusion vulnerability (CWE-73) that requires the attacker to have authenticated access to the system. Once authenticated, an attacker can manipulate file paths to gain access to files they should not be able to read.

The ability to perform local file inclusion can lead to the exposure of sensitive system configuration files, database credentials, or internal application data. With a CVSS score of 7.1, this vulnerability poses a high risk to the confidentiality of the environment, particularly for administrators or users with access to the management interface.

Immediate Action: Upgrade Sangoma Switchvox SMB Edition to version 8.4.0.2 or later to address the file inclusion flaw.

Proactive Monitoring: Monitor system logs for suspicious file access requests or authentication events originating from unusual accounts or IP addresses.

Compensating Controls: Restrict access to the management interface of the Switchvox appliance to trusted internal networks or VPNs to reduce the attack surface.

Public Exploit Available: Unknown.

Administrators must prioritize updating their Switchvox SMB Edition instances to version 8.4.0.2. While the vulnerability requires authentication, the potential for sensitive data exposure makes patching essential to maintain the security posture of the telecommunications infrastructure.