Sangoma Switchvox vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Sangoma Switchvox: 2 record(s), with affected versions and fixes.
cpe:2.3:a:sangoma:switchvox

CVE-2026-9586 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-89 Jul 17, 2026

Sangoma Switchvox SQL Injection Vulnerability

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

CVE-2026-45362 Low · 3.2 CWE-312 May 11, 2026

Cleartext Storage of Sensitive Information in Sangoma Switchvox

Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.