CVE-2020-7030: avaya ip_office Insufficiently Protected Credentials
Vulnerability summary
CVE-2020-7030 is a medium (CVSS 5.5) Insufficiently Protected Credentials vulnerability in avaya ip_office. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-06-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.04%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.04% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAvaya IP Office 11 - Password Disclosure
Maturity: poc
Weaknesses
CWE · root cause- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Avaya1 product
- ip_office≥ 9.0, < 10.0 | ≥ 10.0, < 10.1.0.8 | ≥ 11.0, < 11.0.4.3 | ≥ 10.0, ≤ 10.1.0.7 | ≥ 11.0, ≤ 11.0.4.2 | 9.0 | 9.0:sp1 | 9.0:sp10 | 9.0:sp11 | 9.0:sp12 | 9.0:sp2 | 9.0:sp3 | 9.0:sp4 | 9.0:sp5 | 9.0:sp6 | 9.0:sp7 | 9.0:sp8 | 9.0:sp9 | 9.1 | 9.1:sp1 | 9.1:sp10 | 9.1:sp11 | 9.1:sp12 | 9.1:sp3 | 9.1:sp4 | 9.1:sp5 | 9.1:sp6 | 9.1:sp7 | 9.1:sp8 | 9.1:sp9
1 vendor · 1 product