CVE-2005-0506 Information disclosure in n/a
Local attackers can steal cleartext credentials from the Windows registry to impersonate users in Avaya IP Office Phone Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2005-0506?
CVE-2005-0506 is a medium-severity vulnerability in n/a, published on 22 Feb 2005. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Avaya IP Office Phone Manager, and other products such as the IP Softphone, stores sensitive data in cleartext in a registry key, which allows local and possibly remote users to steal usernames and passwords and impersonate other users via keys such as Avaya\IP400\Generic.
Which versions are affected by CVE-2005-0506?
It affects 2 products.
Products include Avaya Ip Office Phone Manager, Avaya Ip Soft Phone.
How do I fix CVE-2005-0506?
No fix has been published for CVE-2005-0506 yet. Limit exposure of the affected software until one is available.
Is CVE-2005-0506 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-0506 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-9337-pphj-26cr.