CVE-2026-45362
SIP Credentials Exposure in Sangoma Switchvox
Publication date: 2026-05-12
Last updated on: 2026-05-12
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sangoma | switchvox | to 8.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-45362 is a vulnerability in Sangoma Switchvox versions before 8.4 where SIP authentication credentials are stored in plaintext within backup files (.svb). This means that sensitive information such as SIP trunk usernames, passwords, carrier hostnames or IP addresses, and DID assignments can be directly extracted from these backup files if accessed by an attacker.
How can this vulnerability impact me? :
If an attacker gains access to the backup files containing plaintext SIP credentials, they can impersonate the PBX endpoint at the carrier level. This can lead to severe consequences including toll fraud (unauthorized use of telephony services), caller ID spoofing, interception of inbound calls, rerouting of calls, and denial-of-service conditions affecting the telephony system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting Sangoma Switchvox backup files (.svb) for the presence of cleartext SIP authentication credentials such as usernames, passwords, carrier hostnames/IPs, and DID assignments.
A practical approach is to locate and extract the .svb backup files from your system and then search within these files for plaintext SIP credentials.
While specific commands are not detailed in the provided resources, a general method would be to use file inspection and text search commands such as:
- Locate backup files: `find /path/to/backups -name '*.svb'`
- Search for SIP credentials inside backup files: `strings backupfile.svb | grep -iE 'username|password|sip|carrier|did'`
These commands help identify if sensitive SIP credentials are stored in plaintext within backup files, indicating the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, the immediate step is to upgrade Sangoma Switchvox to version 8.4 or later, where the issue has been patched.
Additionally, restrict access to backup files (.svb) to authorized personnel only, as these files contain sensitive SIP trunk credentials in plaintext.
Review and rotate SIP trunk credentials if they may have been exposed, to prevent unauthorized use such as toll fraud or call interception.
Implement strict file permissions and consider encrypting backup files to protect sensitive information from unauthorized access.