Forced Maintenance Renewal for Modules that are NOT being maintained

I have been doing quite a bit of maintenance on my FreePBX’s because of this bug:

Weird PJSIP bug that killed me today - FreePBX / Providers - FreePBX Community Forums

And of course, when I log into the machines, I am constantly getting the message referenced in this post:

So I have been dutifully renewing Support for all my commercial modules - I don’t use that many, but I use System Admin and Endpoint Manager on every single instance.

I understand that Maintenance is an implied contract that says that if I pay you for Maintenance on the Module, you (Sangoma) will keep the module up-to-date as far as Security and Operability - Right.

But you are NOT updating Endpoint Manager in any meaningful way except for your (Sangoma) model phones - I primarily use Polycom, Grandstream, and Yealink phones.

Polycom is missing TONS of newer models, and the models that are there have firmware from 2016 - ten freaking YEARS ago. You don’t even have firmware for the VVX411 (my most common phone) and that came out in 2016 also!

The Grandstream’s latest Firmware in the module is from 2019 - And the updates are HEAVILY focused on Security updates.

Yealink is ridiculous - My favorite Phone (the T44W) came out in January of 2024 - So over two years ago, and it is not even a listed model in the Module - let alone have firmware for it. The Yealink T48U was released in 2021 (five years ago now), is a very popular phone, and you all don’t even make the firmware available for it at all.

This is not right - You all need to maintain this module with current Firmware’s and Model Definitions on an ongoing basis if you expect maintenance renewals to be paid - you all (Sangoma) are not keeping up your end of the bargain.

I completely agree. Here are a couple of other related posts about this on the forum:

:saluting_face:

Thank you!

Would you please post a screenshot of the Dashboard and/or Module Admin page messages that you are seeing (as there could be a few different ones in this category) ?

Also, it would be helpful to know your current module mirror situation by sharing the output from this command on your CLI:

$ fwconsole setting MODULE_REPO

Mirror notwithstanding, the terms of the license are covered at Important Documents - Sangoma Technologies as well as other places. Technically, we are continuously adding new models, recently including some Mitel phones popular in the Verticals > Education K12 space:

No you are NOT! Like I said (above) you haven’t added Polycom models in years - Yealink too. And there is no commitment to the non-Sangoma Firmware’s.

Saying you added some Mitel models like you were maintaining any of the other manufacturer’s phones is very disingenuous - you have not done any REAL maintenance/upgrades on Endpoint Manager for Polycom/Yealink/Grandstream in YEARS.

You posting this reply is not going to satisfy ANY Endpoint Manager subscribers - It’s obvious that the only updates being done are like I said - Phones in the Sangoma family.

All the rest are just neglected.

Here’s some of the significant security fixes that went into End Point Manager over the past year – not shown was the full module audit we did internally as well. :frog:

  1. Authentication Bypass Leading to SQL Injection and RCE · Advisory · FreePBX/security-reporting · GitHub
  2. Authenticated Arbitrary File Upload in Endpoint Manager · Advisory · FreePBX/security-reporting · GitHub
  3. Authenticated SQL Injections in Endpoint Management · Advisory · FreePBX/security-reporting · GitHub
  4. Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API · Advisory · FreePBX/security-reporting · GitHub
  5. Authenticated Command Injection in Network Scanning feature of Endpoint Manager · Advisory · FreePBX/security-reporting · GitHub

All of those patches you reference are for FreePBX - NOT for the individual Manufacturer’s phones.

Security Fixes are fine (and expected) - we need Current Firmware’s (for Security!) and Model Definitions so that we don’t have to band-aid it by using similar models.

I don’t think you understand the Use-Case for Endpoint Manager - We have to be able to provision all the phones that we have in a Secure and Reliable manner - that means a Current Firmware and a Model Definition that matches the phone.

You are WAY off that track for anything other than Sangoma Phones.

Since I’m not a reseller or service provider, I just have to maintain our company’s setup. Might be a dumb question and speaking out of turn, but can you locate updated firmware and load it into EPM, so then the phones can be updated?

Sorry, I don’t use EPM since we just have VVX411 Polycoms (a handful) and mostly Yealinks. So I just have my own on-prem provisioning server where the phones grab their firmware and configs. Just wondering how flexible EPM is when it comes to the firmware aspect.

“but can you locate updated firmware and load it into EPM, so then the phones can be updated?”

Yes you can, but it is another very manual process, and it is error prone.

Specifically to Polycom, we do exactly that, but the newer firmware requires a Basefile Edit to keep the Park buttons working like they should - It’s not difficult to apply, but again, it’s another source of misconfiguration/errors.

The cost of the Endpoint Manager and the Maintenance are what we are paying for to have this done automatically - Not to have to do it all ourselves.

I agree that we should be doing better to keep this up to date. That said, there’s an effort in place to keep this moving along. I think you will be pleasantly surprised by some of the changes that are currently in motion.

That said, our resources get pulled in many directions- We’re faced with a reality that we need balance commercial endeavors with community and platform needs. These are not easy things to balance. There’s more than you’d expect happening behind the scenes and there’s no magic wand to wave. Couple this with the reality that it’s important for me to keep everyone happy and you’ve got an interesting challenge for sure - I’m here for it though! :slight_smile:

RE: EPM

There’s movement - plenty of that movement has been recent. As part of this, we’ve added newer MITEL/Shoretel phones in the mix (Recent events / Partner request). It wasn’t too long ago that we added fanvil phones (the new yealink?). and now, we’re currently working to get the snom product line in and updated. That said, we also have Advanced Network Devices on the docket (excited to have a new unit in my office as I type).

What’s coming soon? Snom lots of it…

Desk phones:

  • D1XX
  • D3XX
  • D7XX
  • D8XX

Special App:

  • SP800
  • PA1+

Multi-Cell DECT:
Base Stations

  • M400
  • M900

Handests

  • M25
  • M30
  • M65
  • M70
  • M80
  • M85
  • M90

Also - The complete hospitality line and Conference too!

Base Stations:

  • M100
  • M250
  • M500

Handsets:

  • M10
  • M50
  • M53
  • M55
  • M56
  • M58

Conference:

  • C620

Hospitality:

  • HD351W
  • HD350W
  • HD341
  • HD340
  • HD331
  • HD300
  • HD3
  • HD30L
  • HD101
  • HD1
  • HM201
  • HM2
  • E303

I’ll do my best to keep everyone in the loop about new adds and updates. But please reach out to me directly if you have something that’s an immediate need, and adheres to the balance I shared above. We need to keep the project moving along and I’m always open for discussions on what we can do better. Feel free to DM directly or to throw the occasional rock via a forum post.

Mike

That’s cool for Mitel/Shoretel - I have over a thousand Polycom\Yealink\Grandstream phones and they need some loving too!

They need to be brought up to current NOW - You already have the Definitions, you just need to expand them and include the newest firmware.

These are great points. For a reseller or service provider, customers can onboard with a variety of SIP desk phones. For a customer with a ton of them, one of the more expensive and painful scenarios is when the rep tells them that all of them will need to be replaced due to compatibility or support issues. That was how I was able to sell our company on moving from managed IP-PBX to FreePBX. Our old Polycom SPIP-450s, SPIP-650s, and VVX-410s could stand pat and “just work” with FreePBX. Although the “just working” involved my manually maintaining the firmware revisions and config files on-prem…

@GSnover kindly requesting your feedback on these previous inquiries…

…as the title of your topic does not comport with the expectations that one should have if they are using Sangoma’s commercial FreePBX modules from the standard, official Sangoma mirror servers.

I don’t even know what that means?

You want this why?

Thank you for sharing those images – this helps narrow down the issue. :slight_smile:

It appears that your End Point Manager (and Fax Pro ?) licenses support/upgrades expired on 2024-05-26T06:00:00Z which means that you could continue to use the versions available at that time for the remaining licensed period (typically 25 years.) Since EPM 16.0.86.21 was tagged on 2024-05-21T06:00:00Z, that is the version that you could continue to use without any “forced maintenance renewal” as your current topic title suggests.

This support and upgrade policy traces back at least ten years:

And the topic is often discussed specifically w/r/t EPM:

…and there’s lots more history like that in the forums. :detective:

:elephant: ElePhant Module in the room

How did you get EPM 16.0.97 installed on your system ? That version was tagged on 2026-03-30T06:00:00Z – almost two years after your license support/upgrade period expired.

Possible scenarios which could have led to this situation:

  1. Have you toggled mirrors to something other than the official Sangoma FreePBX mirrors ?
  2. Or is there some other edge case that you are aware of ?
  3. :bug: Bugs - which are now fixed / stomped on by said elephant :wink: ?

Re-Read my post - I am NOT complaining about having to pay for support renewal - I WANT you all to keep improving the modules - in fact, it’s critical to my offering to my customers that you do!

My complaint is that you are NOT improving the Endpoint Manager module in any way other than FreePBX security and adding a brand of phones (Mitel/Shoretel) that I don’t even use - the brands that are already represented in the module (Polycom/Yealink/Grandstream) are not being maintained in any real sense - missing Model’s of phones, and firmware that is YEARS out of date.

I am happy to pay for work - work is not happening.

fwconsole ma upgradeall - that is how I always upgrade my modules.

I have used ClearlyIP’s mirrors in the past when your mirrors didn’t have the updated module that I needed - are you saying that this is not allowed? Because it has happened several times over the years when it will flag up under Module Admin that I have to update a module to a specific version number to close a vulnerability, but your mirrors don’t have the module available for download, but ClearlyIP’s mirrors always did. Tony and Luke maintain better mirrors than Sangoma.

I don’t know what that sentence means?

I don’t know what this sentence means either.

You are trying to negate my complaint that you all are not maintaining Endpoint Manager by saying that I don’t want to pay, or are using another source that it “Not Allowed” - that is all noise.

You are offering for sale (and support) a module that is not being maintained properly.

That is the problem here - none of this other noise you are bringing up.

Valid feedback on need for module improvement and new third-party phone model support aside, thank you! Let’s please focus on this side quest for a moment:

Specifically this part, first:

The Sangoma Sales team (and Engineering! and QA!) is pretty keen on ensuring that Sangoma’s official FreePBX module mirrors contain every new version of every commercial module available at freepbx.org/add-ons, including all security fixes, feature additions, compatibility improvements and other upgrades. They often confirm directly with the license purchasers whether or not they were able to install the latest version available in order to correct warnings like you report seeing on the Module Admin page.

But if you don’t pay for the support/upgrades… :thinking:

Finally, :anxious_face_with_sweat: struggling with the definition of the word “better” as used in your last sentence:

Who is doing What and How is that the case ?!?

No - your mirror was not coughing up the upgraded module because it was not licensed - it was not showing it present on the mirror! It was most likely to happen with minor (third rev level 17.6.xx) updates to things like Core - And it happened MANY times.

Surely you have seen this behavoir…

Tony Lewis and Luke Duquaine of ClearlyIP - because of the reason above.

FreePBX was much more tightly maintained when Tony’s crew was in charge of it…

Exactly! The official Sangoma commercial FreePBX module happy path was built to “stop you from upgrading modules without the maint contract” as described here in 2016 (link posted previously in my earlier comment):

^^^ if you handled those restrictions by paying for annual upgrades then this is a big nothing-burger (or at most, a minor bug), but, if you instead solved the problem by switching mirrors, well, doesn’t that seem different ?

If there were more trees like this falling in the woods – as in, customers paying for commercial module security upgrades they see warning messages about in the GUI but then are unable to obtain – would there be more sound about it in the forums ? :evergreen_tree: :axe:

I suppose out of all of this I would just like some black and white language, of where things stand, not emojis, jokes, and euphemisms. For Sangoma customers using ClearlyIP Repos that have paid for all module renewals, and Platinum Sangoma support Annually? I need to know what if anything needs to be done.

Dang it - You are not reading what I said - The modules that were not present on the Sangoma mirrors were GPLv3 licensed modules - as in not Commercial Modules - they were modules like Core:

GPLv3+ - not commercial.

Besides which, I don’t care about your beef with ClearlyIP and @tonyclewis - That was never even a part of this post - I will say it again so it doesn’t get lost:

Endpoint Manager, by its very nature, needs constant updating to include Firmware and Model updates - When a new firmware comes out, it needs to be made available. When a new model is introduced, a definition needs to be added to the Brand - that is NOT happening with Polycom, Yealink, and Grandstream.

That’s it - you guys need to do better.