# Your Phone System Is a Backdoor: Sangoma Switchvox Vulnerabilities Are Being Exploited Right Now
When attackers start hitting your business phone system, the first thing most security teams do is look somewhere else. PBX platforms sit in a strange organizational gray zone — too technical for the telecom vendor, too "legacy" for the cloud-first security team, and too unglamorous for anyone to prioritize patching. Sangoma Switchvox just became the latest proof that this neglect has consequences.
Vulnerabilities in Switchvox, Sangoma's unified communications platform built atop the Asterisk open-source engine, are now confirmed to be exploited in the wild. This isn't a theoretical risk or a researcher's proof-of-concept. Active exploitation means attackers are already inside some organizations' networks through their phone systems, and most of those organizations probably don't know it.
## What Switchvox Is and Who Runs It
Switchvox targets the SMB market — the exact segment least likely to have a dedicated security team reviewing patch cadence on their UC platform. It provides hosted and on-premise voice, video, and messaging through a web-based admin interface. Sangoma acquired Digium in 2018, inheriting Switchvox's substantial installed base, and the product remains widely deployed across healthcare, legal, and professional services firms.
The on-premise deployment model is the critical detail here. Unlike cloud-hosted systems where the vendor handles patching, on-premise Switchvox deployments require administrators to push updates themselves. In practice, many of these systems run for months or years between updates — administrators either don't receive alerts, don't treat the phone system as a security-critical asset, or deprioritize downtime for a system that "just works." Until it doesn't.
## What Exploitation Looks Like
VoIP and unified communications platforms present attackers with an unusual attack surface. A compromised PBX isn't just a communications breach — it's a network foothold. Switchvox systems sit on internal networks with trust relationships to other infrastructure. Once an attacker gains access, the attack paths branch quickly.
The obvious and immediate risk is toll fraud: attackers route high-rate international calls through compromised PBX systems, racking up charges of thousands to tens of thousands of dollars in hours. But that's the noisy version. More sophisticated actors use PBX compromise as quiet lateral movement infrastructure — the phone system has network access, legitimate-looking traffic patterns, and often minimal endpoint detection coverage.
Interception is the risk that should concern regulated industries most. A Switchvox deployment in a law firm or healthcare practice carries call recordings, voicemails, and real-time audio streams. Admin-level access means access to all of it. Attorney-client privilege, protected health information, and M&A discussions don't typically get flagged in threat models centered on endpoint and cloud security.
## The Patch Gap Problem in Telecom Infrastructure
Sangoma has a history of releasing security updates, but the gap between "patch released" and "patch applied" in VoIP environments is genuinely alarming. Asterisk-based systems in particular tend to run on Linux hosts managed by administrators whose primary job is telephony, not security. These aren't bad administrators — they're working within a tool set and organizational structure that treated the phone system as infrastructure rather than an attack surface.
CISA's Known Exploited Vulnerabilities catalog has repeatedly added telecom and network infrastructure flaws because attackers follow the path of least resistance. After years of improved endpoint security postures and cloud provider hardening, legacy on-premise communication systems have become comparatively soft targets. The organizations running them often have no EDR on the host, no network segmentation isolating the PBX, and no alerting on unusual call routing patterns.
This is a solvable problem, but only if organizations first recognize that their phone system is a cybersecurity asset — not just a business utility.
## Who Should Be Most Worried
Not every Switchvox deployment carries the same risk profile. The highest-exposure organizations share a few traits:
Externally accessible admin interfaces. Web-based administration should never be exposed directly to the internet. Shodan searches regularly surface Switchvox admin panels reachable without a VPN. If your PBX management interface is internet-routable, assume it's been scanned.
Unpatched systems running 12+ months behind current releases. Sangoma releases security bulletins; check them. If your Switchvox version is more than one major release behind, you're likely running with known vulnerabilities, possibly including the ones being actively exploited now.
No network segmentation around the PBX. A phone system that can route traffic to your file servers, your EHR, or your finance systems is a lateral movement problem waiting to happen. VoIP infrastructure should sit in its own VLAN with strict egress rules.
No monitoring for toll fraud or unusual call patterns. Attackers conducting toll fraud generate obvious anomalies — unusual destination countries, call volumes spiking outside business hours, routes that don't match normal usage. These are detectable if anyone is looking.
## Immediate Steps
The patch cadence on Switchvox needs to match the cadence you apply to anything else on your perimeter. That means checking Sangoma's security advisories now, identifying which CVEs are confirmed exploited, and testing updates in a staging environment before production rollout.
Beyond patching, the hardening work that should have happened years ago:
Disable or restrict the web admin interface to internal networks only, preferably behind a VPN with MFA. Review all outbound call routing to ensure there are no unexpected international routes. Enable call detail record logging if it isn't already active, and configure alerts on high-volume or high-cost call patterns. Audit which network resources the Switchvox host can reach — it should talk to your SIP trunks and not much else.
---
## HackWire Analysis
The Switchvox exploitation news fits a pattern that's been building for two years: attackers are systematically working through on-premise communication infrastructure that survived the cloud migration era without getting properly hardened.
There's a specific reason this is happening now. The security community spent the last five years dramatically improving visibility into endpoints, cloud environments, and identity systems. Attackers adapt. The relative return on exploiting a well-monitored corporate laptop versus an unmonitored PBX on a flat network has shifted decisively toward the PBX.
What's missing from most coverage of VoIP exploitation is the regulatory exposure angle. HIPAA-covered entities running Switchvox in healthcare settings face a dual problem: the breach itself and the OCR reporting obligation that follows. A compromised PBX that captures voicemails from patients or records calls containing PHI is a reportable incident under most interpretations of the Security Rule. Legal and financial services firms face equivalent obligations under various state privacy frameworks. The breach isn't just an IT problem — it's a compliance event that multiplies the cost substantially.
The other underreported detail: cloud-hosted Switchvox deployments managed by Sangoma directly are a different threat model, but organizations running hybrid environments or managing their own cloud VMs are not automatically protected. Patch management responsibility doesn't disappear because the server lives in AWS.
The most likely victims of active exploitation here are mid-sized professional services firms — enough revenue to make toll fraud worthwhile, enough infrastructure complexity to create lateral movement opportunity, and slim enough IT teams that the phone system has never been threat-modeled. If that's your organization, the window to get ahead of this is closing.
— HackWire Editorial
---
## Related Coverage