# CVE-2026-45362: Sangoma Switchvox cleartext SIP credentials in backup file

Source: https://junglewise.ai/threats/cve-2026-45362-sangoma-switchvox-cleartext-sip-credentials-in-backup-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-45362 · Severity: low · CVSS 3.2 · Published 2026-05-12

Sangoma Switchvox, a business phone system (PBX), was found to store sensitive phone service credentials in unencrypted plain text within its system backup files. If an unauthorized person gains access to one of these backup files, they could steal the credentials used to connect the phone system to the external carrier. This could allow an attacker to make fraudulent long-distance calls, intercept incoming business calls, or spoof the company's caller ID, potentially leading to financial loss and reputational damage.

Vendors: [Sangoma](https://junglewise.ai/threats/vendors/sangoma).

## Quick answers

**Is CVE-2026-45362 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45362 being exploited in the wild.

**How severe is CVE-2026-45362?** Low severity, with a CVSS score of 3.2, published 12 May 2026.

**Which products and versions are affected?** Sangoma Switchvox before 8.4.

**Is there a fix for CVE-2026-45362?** A patch was published on 2026-05-12: Remediation released in version 8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45362 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-45362?** Check whether you run Sangoma Switchvox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Sangoma Switchvox prior to version 8.4 suffers from a cleartext storage vulnerability (CWE-312) within its proprietary .svb backup format. The backup files contain SIP trunk authentication usernames, passwords, carrier hostnames, and DID assignments without encryption or obfuscation. While the CVSS 3.1 score is rated as Low (3.2) due to the local access requirement to obtain the backup file, the impact of credential extraction is significant. An attacker with access to a backup file can extract these details to register directly with the upstream SIP carrier, enabling toll fraud, inbound call interception, and caller ID spoofing. This issue was remediated in Switchvox version 8.4.

## Affected products

- Sangoma Switchvox before 8.4

## Timeline

- 2026-05-11: disclosed: Coordinated disclosure initiated and CVE assigned
- 2026-05-12: advisory: NVD publication date
- 2026-05-12: patched: Remediation released in version 8.4

## References

- [https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mfm3-g35x-c9w8](https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mfm3-g35x-c9w8)
- [https://github.com/wb6vpm/switchvox-svb-plaintext-sip-credentials/](https://github.com/wb6vpm/switchvox-svb-plaintext-sip-credentials/)

## Related threats

- [Sangoma Switchvox SMB SQL injection in /pa endpoint](https://junglewise.ai/threats/cve-2026-9586-sangoma-switchvox-smb-sql-injection-in-pa-endpoint)