Since build 5.2.795 it is possible to listen CLI port from certain interfaces only with the following parameter in flashphoner.properties file
cli.address=localhost
By defailt, CLI is accessible from local interface only. Interface addresses can be comma separated
cli.address=localhost,192.168.0.100
In this example, access is allowed from local interace and from internal network.
To apply settings, WCS should be restarted.