Sangoma Switchvox software versions prior to 8.4 generate backup archives that store SIP authentication credentials in plain text. This flaw allows anyone with access to the backup file to read the authentication tokens, potentially gaining unauthorized access to the VoIP system.

The affected product is Sangoma Switchvox, all releases earlier than version 8.4. Customers using those versions should verify backup files for cleartext credentials.

The CVSS score of 3.2 indicates low severity; however, the exposure of authentication credentials can enable lateral movement and unauthorized control of calls. No EPSS data and the vulnerability is not listed in the KEV catalog. The likely attack vector is local or network access to the device's backup storage, where an attacker who can read or obtain the backup file can exploit the flaw.