Summary
- Affected: ASTPP 6.0 Community Edition, all releases up to V6.0.6 and the V6.0 branch up to commit 9479778d. Older versions were not tested.
- Fixed in: ASTPP 6.2, released on 6 November 2026 (release v6.2).
- Scope: 61 security issues and 15 functional defects.
| Severity | Issues |
|---|---|
| Critical | 7 |
| High | 23 |
| Medium | 19 |
| Low / operational | 12 |
| Total | 61 |
Timeline
We reported the issues to iNextrix in October 2026, together with fixes for all findings. iNextrix adopted the fixes and released them as ASTPP 6.2 on 6 November 2026. Thank you to the iNextrix team for the quick response and the good cooperation.
We do not publish technical details or exploitation steps.
Main issues
- Without login: SQL injection through SIP registrations and calls, FreeSWITCH commands and maintenance functions reachable over the web, call recordings readable without login, calls billed to other accounts through caller-controlled SIP headers.
- Keys and credentials: the same publicly known keys on every installation, a demo account with published passwords, and predictable passwords, PINs and one-time codes.
- Privacy: data of the installation and its customers was sent to the vendor without notice or consent. The transfer has been removed from the code; iNextrix has published its own notice.
- Portal (resellers and customers): missing authorization checks gave access to records of other accounts and tenants and allowed role changes.
- Money flows: prices, coupons, credit transfers, invoices and PayPal payment notifications could be manipulated.
- Logged-in users (depending on the role): file upload leading to code execution, command injection and SQL injection in several functions.
What operators should do now
- Upgrade to ASTPP 6.2 and follow the vendor's upgrade notes. This includes importing
database/astpp-6.2.sql, which the new code requires. - Replace the keys: if
astpp-config.confstill contains the shippedPRIVATE_KEYandENCRYPTION_KEY, replace them with random values. Values encrypted with the oldPRIVATE_KEYcan no longer be read after the change, so plan it together with the upgrade notes. - Replace passwords and PINs that ASTPP 6.0 generated (portal, SIP devices, calling cards). They are predictable.
- Uninstall the API add-on (
addons/Community/api) if it is installed. It is not fixed in 6.2, and iNextrix also recommends removing it. - Until you have upgraded: restrict access to the web interface and the SIP ports to known addresses, keep public self-signup and PayPal disabled, and give portal access only to resellers and customers you fully trust.
CVE identifiers
The findings have been submitted to iNextrix as security advisories on GitHub. iNextrix requests the CVE identifiers and publishes the advisories at github.com/inextrix/ASTPP/security/advisories. We will add the identifiers here once they are assigned.
PHP 8.5
ASTPP 6.2 still requires PHP 7.4, which has not received security updates since November 2022. iNextrix plans PHP 8.5 support for a later release; we have submitted our changes for it as a pull request. We run ASTPP ourselves on Debian 13 with PHP 8.5. Our hardened fork is publicly available at github.com/infrahost/astpp-hardened (AGPL-3.0).
Credits
Found and reported by infrahost and Raphael Schneeberger (github.com/ScIT-Raphael). For questions about the update, contact us at info@infrahost.ch.
White-label cloud and managed-service infrastructure for Swiss IT providers. A service of ScIT Informatik GmbH.