Sangoma Session Border Controller Firmware vulnerabilities

CVE-2019-12148 [CRITICAL] CWE-88 CVE-2019-12148: The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authenti The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field. Upon successful exploitation, a remote unauthenticated user can login into the device's admin web portal without providing any credentials. This

CVE-2019-12147 [CRITICAL] CWE-88 CVE-2019-12147: The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument In The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system user with sudo privileges, and use that user to login to the system (either via the web interface or via SSH)