Since build 5.2.795 it is possible to listen CLI port from certain interfaces only with the following parameter in flashphoner.properties file
By defailt, CLI is accessible from local interface only. Interface addresses can be comma separated
In this example, access is allowed from local interace and from internal network.
To apply settings, WCS should be restarted.