CVE-2025-32105

The vulnerability results from improper input handling in the HTTP server embedded in the Sangoma IMG2020 device firmware (CWE-120 — classic buffer overflow). An attacker can send a crafted HTTP request that causes a buffer overflow in the memory of the server process. As a result, it is possible to overwrite critical memory areas and take control of the program execution flow, leading to remote code execution.

An unauthenticated network attacker can gain full control of the device through remote code execution (RCE), which potentially enables interception of telecommunications traffic, lateral movement in the network, and complete compromise of the device.

Apply patches available from the manufacturer according to references. Until the fix is implemented, it is recommended to restrict access to the HTTP interface of the Sangoma IMG2020 device exclusively to trusted IP addresses using firewall or network segmentation.

Sangoma IMG2020 Firmware and Sangoma IMG2020 device in versions up to and including 2.3.9.6