Tag: voip
-
CVE-2025-64328 exploitation impacts 900 Sangoma FreePBX instances
About 900 Sangoma FreePBX systems were infected with web shells after attackers exploited a command injection flaw. Hundreds of Sangoma FreePBX instances are still infected with web shells following attacks that began in December 2025. Sangoma FreePBX is an open-source, web-based platform for managing Asterisk-powered VoIP phone systems. Maintained by Sangoma Technologies, it allows businesses…
-
Grandstream VoIP Phones Vulnerability Grants Attackers Root Privileges
A critical unauthenticated stack-based buffer overflow vulnerability, tracked as CVE-2026-2329, affecting Grandstream GXP1600 series VoIP phones. The vulnerability, rated as critical with a CVSS score of 9.8, allows remote attackers to gain root privileges on the affected devices without authentication. At its core, this is a classic memory corruption vulnerability. By sending specially crafted network packets to the target VoIP phone, an attacker…
-
Flaw in Grandstream VoIP phones allows stealthy eavesdropping
A critical vulnerability in Grandstream GXP1600 series VoIP phones allows a remote, unauthenticated attacker to gain root privileges and silently eavesdrop on communications. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/flaw-in-grandstream-voip-phones-allows-stealthy-eavesdropping/
-
Bug in widely used VoIP phones allows stealthy network footholds, call interception (CVE-2026-2329)
A critical security vulnerability (CVE-2026-2329) in Grandstream VoIP phones could let hackers remotely take full control of the devices and even intercept calls, Rapid7 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/19/grandstream-voip-phones-vulnerability-cve-2026-2329/
-
Critical Grandstream VoIP Bug Highlights SMB Security Blind Spot
CVE-2026-2329 allows unauthenticated root-level access to SMB phone infrastructure, so attackers can intercept calls, commit toll fraud, and impersonate users. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/grandstream-bug-voip-security-blind-spot
-
Grandstream GXP1600 VoIP Phones Exposed to Unauthenticated Remote Code Execution
Tags: control, cve, cvss, cybersecurity, data-breach, flaw, phone, remote-code-execution, voip, vulnerabilityCybersecurity researchers have disclosed a critical security flaw in the Grandstream GXP1600 series of VoIP phones that could allow an attacker to seize control of susceptible devices.The vulnerability, tracked as CVE-2026-2329, carries a CVSS score of 9.3 out of a maximum of 10.0. It has been described as a case of unauthenticated stack-based buffer overflow…
-
Der Raspberry-Pi-Weckruf für CISOs
Tags: access, authentication, ceo, ciso, control, cyberattack, dns, firewall, group, hacker, Hardware, infrastructure, linux, monitoring, office, risk, switch, tool, voip, vpnKleines Device, große Wirkung.Mitte Dezember wurde eine Fähre in Besitz der Mediterranean Shipping Company über Stunden in einem französischen Hafen festgesetzt, wie Bloomberg berichtete. Der Grund: Es bestand der Verdacht, dass russische Cyberkriminelle versucht haben, das Netzwerk des Schiffs zu hacken mit einem Raspberry Pi. Dieser war demnach mit einem Mobilfunkmodem gekoppelt, das den Fernzugriff…
-
EOL-Software gefährdet Unternehmenssicherheit
Geräte mit End-of-Life-Software (EOL) stellen nach wie vor ein weit verbreitetes Sicherheitsproblem in Unternehmen dar.Laut einer Studie von Palo Alto Networks laufen 26 Prozent der Linux-Systeme und acht Prozent der Windows-Systeme mit veralteten Versionen. Die Ergebnisse basieren auf Telemetriedaten von 27 Millionen Geräten in den Netzwerken von 1.800 Unternehmen.Die Analyse offenbart zudem, dass 39 Prozent…
-
DTTS – Zero Trust DNS Enforcement: Policy Violation Management
In a default-deny world, where only verified sources and verified destinations are allowed, which require a successful policy-allowed DNS resolution, many modern threats are mitigated, and there’s demonstrable value in choosing this path, including being able to enforce “My network, my rules” approach to egress control. However, in this world where existing applications need to…
-
FreePBX SQL Injection Vulnerability Leads to Database Tampering
A critical SQL injection vulnerability in FreePBX, designated as CVE-2025-57819, has been actively exploited by attackers to modify the database and achieve arbitrary code execution on vulnerable systems. The vulnerability affects the popular open-source PBX platform that provides a web-based administration interface for managing Asterisk VoIP systems across all supported versions including FreePBX 15, 16, and…
-
New VoIP Botnet Targets Routers Using Default Passwords
Tags: attack, botnet, cyber, cybersecurity, exploit, intelligence, malicious, password, router, voipCybersecurity researchers have uncovered a sophisticated botnet operation exploiting VoIP-enabled routers through default password attacks, with initial activity concentrated in rural New Mexico before expanding globally to compromise approximately 500 devices. The discovery began when GreyNoise Intelligence engineers noticed an unusual cluster of malicious IP addresses originating from a sparsely populated region of New Mexico…
-
Report: Next-Gen 911 Systems are Outpacing Cyber Defenses
Research Shows Next-Generation 9-1-1 Ecosystems Lack Critical Cyber Protections. A report from telecom firm Intrado warns that cybersecurity safeguards are lagging behind the rapid deployment of next-generation 911 systems, exposing the emergency ecosystem to attacks ranging from VoIP floods to ransomware amid growing reliance on cloud-based and IP-connected technologies. First seen on govinfosecurity.com Jump to…
-
Threat Actors Accelerate Transition from Reconnaissance to Compromise New Report Finds
Tags: api, attack, automation, cloud, cyber, cybercrime, data, data-breach, identity, technology, threat, tool, voipCybercriminals are leveraging automation across the entire attack chain, drastically reducing the time from reconnaissance to compromise. The data shows a staggering 16.7% global increase in scans, with over 36,000 scans per second targeting not just exposed ports but delving into operational technology (OT), cloud APIs, and identity layers. Sophisticated tools probe SIP-based VoIP systems,…
-
Local Privilege Escalation via Unquoted Search Path in Plantronics Hub
This blog post describes an unquoted search path vulnerability and its exploitation in the Plantronics Hub software. This client software is used to configure Plantronics audio devices such as headsets. Plantronics Hub is therefore often additionally installed by VoIP or SIP software solutions to ensure compatibility between the headset and the telephony software. First seen…
-
Robocallers posing as FCC fraud prevention team call FCC staff
The FCC has proposed a $4,492,500 fine against VoIP service provider Telnyx for allegedly allowing customers to make robocalls posing as fictitious FCC “Fraud Prevention Team,” by failing to comply with Know Your Customer (KYC) rules. However, Telnyx says the FCC is mistaken and denies the accusations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/robocallers-posing-as-fcc-fraud-prevention-team-call-fcc-staff/
-
Mitel MiCollab VoIP Software: Zero-Day Vulnerability Alert
No Patch Yet Available for Second Zero Day To Be Recently Found in VoIP Software. Security researchers warn of a newly discovered zero-day vulnerability in widely used VoIP telephony software, a discovery that comes as the United States struggles to evict Chinese nation-state hackers from telecom networks. The software is the MiCollab software suite from…
-
Vishing, Wangiri, and Other VoIP Fraud Tactics On the Rise
Protect your business from VoIP fraud. Learn how to recognize the most common types and harden your phone system security. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/voip-fraud/
-
Sicherheitsupdates: Root-Attacken auf VoIP-Adapter von Cisco möglich
First seen on heise.de Jump to article: www.heise.de/news/Sicherheitsupdates-Root-Attacken-auf-VoIP-Adapter-von-Cisco-moeglich-9984192.html
-
The 5 Best VoIP Routers (Wired, Wireless, and Mesh)
First seen on techrepublic.com Jump to article: www.techrepublic.com/article/best-voip-routers/
-
5 Compelling Reasons Not to Manage Your Own VoIP Server
Tags: voipFirst seen on techrepublic.com Jump to article: www.techrepublic.com/article/voip-server/
-
Angreifer können Ciscos VoIP-System Unified Communications Manager lahmlegen
First seen on heise.de Jump to article: www.heise.de/news/Angreifer-koennen-Ciscos-VoIP-System-Unified-Communications-Manager-lahmlegen-9843447.html
-
A Look at the Riskiest Connected Devices of 2024
VoIP gear, hypervisors, medical equipment, building automation, printers, and more pose broad risk to organizations, with many facing danger from a co… First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/riskiest-connected-devices-2024
-
Cisco Duo Data Breach: Hackers Stolen VoIP SMS for MFA
Cisco’s Duo Security, a leading multi-factor authentication (MFA) service, has suffered a significant data breach. The April 1, 2024, incident involve… First seen on gbhackers.com Jump to article: gbhackers.com/cisco-duo-data-breach/
-
Cisco Duo warns third-party data breach exposed SMS MFA logs
Cisco Duo’s security team warns that hackers stole some customers’ VoIP and SMS logs for multi-factor authentication (MFA) messages in a cyberattack o… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-duo-warns-third-party-data-breach-exposed-sms-mfa-logs/
-
Hackers Claim 740GB of Data Stolen from Viber VOIP Platform
Viber, known for its encrypted messaging and voice services, boasts millions of users worldwide who rely on its platform for secure communication. The… First seen on gbhackers.com Jump to article: gbhackers.com/hackers-claim-of-data-stolen/
-
FCC Requires Telecom & VoIP Providers to Report PII Breaches
First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/fcc-requires-telecom-voip-providers-to-report-pii-breaches