Since build 5.2.795 it is possible to listen CLI port from certain interfaces only with the following parameter in flashphoner.properties file

cli.address=localhost

By defailt, CLI is accessible from local interface only. Interface addresses can be comma separated

cli.address=localhost,192.168.0.100

In this example, access is allowed from local interace and from internal network.

To apply settings, WCS should be restarted.