CVE-2022-29330
MediumCVSS 4.9Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Missing access control in the backup system of Telesoft VitalPBX before version 3.2.1 allows attackers to access PJSIP and SIP extension credentials, cryptographic keys, and voicemail files via unspecified vectors.
Risk Assessment
The organization is at risk of leaking sensitive credentials and cryptographic keys, which could lead to unauthorized access to the phone system and eavesdropping on calls.
Recommendation
Immediately update Telesoft VitalPBX to version 3.2.1 or later, which includes a fix for the missing access control in the backup system.
Original NVD description (English source)
Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors.