VoIP: Sangoma Switchvox CVE-2026-9586 in KEV, sngrep CVE-2026-90558 a 9.8 RCE

Two vulnerabilities hit IP telephony from opposite ends: the PBX that handles calls, and the diagnostic tool administrators use to troubleshoot it.

CVE-2026-9586 — Switchvox: a single request

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

KEV added: 2026-09-02. CISA deadline: 2026-09-05. NVD has published no score or versions at the time of writing — the fixed release is in the Sangoma advisory.

The description contains three phrases that place the severity: unauthenticated, single crafted request, remote code execution. No account, no complex chain, ending in code execution on the PBX.

What a PBX holds

A PBX isn't an innocuous application server:

• Call recordings and voicemail — often sensitive commercial, legal or HR conversations
• The organisation's full directory and call logs (who calls whom, when, for how long)
• SIP trunk credentials to the carrier

That last point opens a risk other CVE categories lack: toll fraud. An attacker who controls the PBX or recovers trunk credentials can place calls to international premium-rate numbers they control. The bill arrives at month's end, easily runs into tens of thousands of euros over a weekend, and the organisation pays it — carriers generally consider calls placed from an authenticated account to be owed.

CVE-2026-90558 — sngrep: the diagnostic tool becomes the attack surface

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

sngrep is the tool nearly every VoIP administrator runs to understand why a call won't connect: it captures SIP traffic and renders it as call-flow diagrams in the terminal. It's an excellent tool, and that's precisely what makes this flaw interesting.

Why it's worse than it looks

sngrep parses traffic coming from the internet. The SIP port 5060 on an exposed PBX constantly receives packets from automated scanners. When an administrator launches sngrep to debug, it reads all of that traffic — including whatever an attacker forged for it.

sngrep almost always runs with elevated privileges. Packet capture requires privileged network access; in practice many run it directly as root on the PBX itself.

The attacker doesn't need the victim to make a mistake. They send booby-trapped SIP packets and wait. The day an administrator opens sngrep for some unrelated reason, the overflow fires on the production machine, with the administrator's rights.

It's a rare and instructive pattern: a diagnostic tool, used by the most privileged person, precisely when they're looking for a problem.

Checking Exposure

# sngrep
sngrep -V
dpkg -l | grep sngrep      # Debian / Ubuntu
rpm -q sngrep              # RHEL / Rocky

Switchvox: Admin → Server → Updates / About

# Is the PBX reachable over SIP from the internet?
# (run from outside)
nmap -sU -p 5060 <public-ip>
nmap -sT -p 5060,5061 <public-ip>

Detection

Switchvox

• Abnormal PostgreSQL errors in application logs — injection attempts leave traces before successful ones
• Administrator accounts or extensions created recently
• Outbound calls to unusual international destinations, particularly outside business hours — the most reliable toll-fraud signal
• Changes to outbound routing or trunks

sngrep

• Crashes of sngrep at startup or when displaying a session — a failed overflow takes the process down
• SIP packets with Call-ID or X-Call-ID values over 255 bytes in captures (a legitimate Call-ID is a few dozen characters)

Mitigation

1. Switchvox: apply the Sangoma fix

The CISA deadline was September 5. Check the Sangoma advisory for the applicable release.

2. sngrep: update past 1.8.4

And meanwhile, don't run sngrep as root on an exposed machine. Two alternatives:

# Capture first, analyse later on an isolated machine
tcpdump -i any -s 0 -w /tmp/sip.pcap port 5060
# then, on an analysis workstation with no access to the production network:
sngrep -I sip.pcap

Or grant the binary only the capture capabilities rather than root:

setcap cap_net_raw,cap_net_admin=eip $(which sngrep)

3. Reduce SIP exposure

• Don't expose the SIP port to the whole internet: restrict to the carrier's and remote sites' addresses
• Limit permitted international destinations to what's strictly needed
• A spending cap or usage alert with the carrier — the measure that bounds the cost of fraud, whatever flaw is exploited

4. If you suspect the PBX was compromised

1. Cut outbound international calling immediately
2. Notify the carrier — the sooner they know, the more room there is to negotiate the bill
3. Rotate credentials for SIP trunks, extensions and administrator accounts
4. Treat recordings and voicemail as potentially accessed

Why Continuous Monitoring of Telephony Infrastructure Matters

IP telephony often lives apart: installed by a specialist integrator, administered by a separate team, absent from application inventories. Yet it combines near-systematic internet exposure with a direct financial risk few other systems carry.

With cveo.tech, inventory your PBXs, SIP gateways and VoIP tools with exact versions, and get automatic alerts whenever a critical CVE affects them.