CVE-2026-9586
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Risk Assessment
The risk for the organization includes full compromise of the PostgreSQL database, potentially leading to data breach, data modification or deletion, and possible remote code execution on the server.
Recommendation
Immediately upgrade Sangoma Switchvox SMB Edition to the latest available version that fixes this vulnerability. As a workaround, restrict access to the /pa endpoint to trusted IP addresses and deploy a Web Application Firewall (WAF) to block malicious XML requests.
Original NVD description (English source)
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.