Avaya IP Soft Phone vulnerabilities

3 CVEs affecting Avaya IP Soft Phone, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2008-6141, published 2009-02-14.

More from Avaya.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2005-0506, published 2005-03-14. Medium severity, CVSS 5.0. EPSS: 2.8% chance of exploitation in the next 30 days. The Avaya IP Office Phone Manager, and other products such as the IP Softphone, stores sensitive data in cleartext in a registry key, which allows local and possibly remote users to steal usernames…
• CVE-2007-3286, published 2007-09-19. Medium severity, CVSS 6.8. EPSS: 2.5% chance of exploitation in the next 30 days. Multiple buffer overflows in unspecified ActiveX controls in COM objects in Avaya IP Softphone R5.2 before SP3, and R6.0, allow remote attackers to execute arbitrary code via unspecified vectors.
• CVE-2008-6141, published 2009-02-14. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. Unspecified vulnerability in Avaya IP Softphone 6.0 SP4 and 6.01.85 allows remote attackers to cause a denial of service (crash) via a large amount of H.323 data.