CVE-2026-45362: CWE-312 Cleartext Storage of Sensitive Information in Sangoma Switchvox
CVE-2026-45362 is a vulnerability in Sangoma Switchvox versions before 8.4 where SIP authentication credentials are stored in cleartext within backup files. This cleartext storage of sensitive information could allow an attacker with local access to the backup files to obtain SIP credentials. The vulnerability has a low severity rating with a CVSS score of 3.2. There is no information about an available patch or official remediation at this time.
AI Analysis
Technical Summary
Sangoma Switchvox before version 8.4 stores SIP authentication credentials in cleartext in backup files. This improper storage of sensitive information corresponds to CWE-312. The vulnerability has a CVSS 3.1 base score of 3.2, indicating low severity, with an attack vector requiring local access and high attack complexity. No privileges or user interaction are required, and the impact is limited to confidentiality loss of SIP credentials without integrity or availability impact. No vendor advisory or patch information is currently available.
Potential Impact
The vulnerability allows disclosure of SIP authentication credentials stored in backup files in cleartext. An attacker with access to these backup files could obtain these credentials, potentially compromising SIP communications. However, the impact is limited to confidentiality and does not affect integrity or availability. The low CVSS score reflects the requirement for local access and high attack complexity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to backup files containing SIP credentials to trusted personnel only and ensure secure storage and handling of backup data to minimize risk.
CVE-2026-45362: CWE-312 Cleartext Storage of Sensitive Information in Sangoma Switchvox
Description
CVE-2026-45362 is a vulnerability in Sangoma Switchvox versions before 8.4 where SIP authentication credentials are stored in cleartext within backup files. This cleartext storage of sensitive information could allow an attacker with local access to the backup files to obtain SIP credentials. The vulnerability has a low severity rating with a CVSS score of 3.2. There is no information about an available patch or official remediation at this time.
CVSS v3.1
Score 3.2low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Sangoma Switchvox before version 8.4 stores SIP authentication credentials in cleartext in backup files. This improper storage of sensitive information corresponds to CWE-312. The vulnerability has a CVSS 3.1 base score of 3.2, indicating low severity, with an attack vector requiring local access and high attack complexity. No privileges or user interaction are required, and the impact is limited to confidentiality loss of SIP credentials without integrity or availability impact. No vendor advisory or patch information is currently available.
Potential Impact
The vulnerability allows disclosure of SIP authentication credentials stored in backup files in cleartext. An attacker with access to these backup files could obtain these credentials, potentially compromising SIP communications. However, the impact is limited to confidentiality and does not affect integrity or availability. The low CVSS score reflects the requirement for local access and high attack complexity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to backup files containing SIP credentials to trusted personnel only and ensure secure storage and handling of backup data to minimize risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-05-12T00:40:57.663Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a028743cbff5d86108b5061
Added to database: 05/12/2026, 01:49:55 UTC
Last enriched: 05/19/2026, 11:01:25 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 321
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.