CVE-2022-29330

4.9 mediumEPSS 0.9%

Medium (4.9) in vitalpbx vitalpbx. EPSS 0.9% chance of exploitation in the next 30 days.

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors.

Severity

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-330
Published: 2022-06-24
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

vitalpbx:vitalpbx

References

https://www.arsouyes.org/blog/2022/2022-06-30-VitalPBX-0day
https://www.arsouyes.org/blog/2022/2022-06-30-VitalPBX-0day

Check your stack JSON