CVE-2020-7030: IPO Information Disclosure

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-06-04 · updated 2026-06-17
Weakness: CWE-522

Description

A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3.

Affected products

Avaya IP Office: from 10.0 through 10.1.0.7; from 11.0 through 11.0.4.2; 9.0, 9.0-sp1, 9.0-sp10, 9.0-sp11, 9.0-sp12, 9.0-sp2 (+19)

References

http://packetstormsecurity.com/files/157957/Avaya-IP-Office-11-Insecure-Transit-Password-Disclosure.html
http://seclists.org/fulldisclosure/2020/Jun/12
https://downloads.avaya.com/css/P8/documents/101067493
http://packetstormsecurity.com/files/157957/Avaya-IP-Office-11-Insecure-Transit-Password-Disclosure.html
http://seclists.org/fulldisclosure/2020/Jun/12
https://downloads.avaya.com/css/P8/documents/101067493

Get alerted when CVE-2020-7030 or the next vulnerability affects your stack