CVE-2005-0506: The Avaya IP Office Phone Manager, and other products such as the IP Softphone, stores sensitive data in cl...

Security readout for executives and security teams

Some Avaya IP Office client software stored usernames and passwords in cleartext in the Windows registry. Anyone able to read the affected registry data could steal credentials and impersonate users. Business risk depends on whether these legacy Avaya clients remain installed and whether endpoint access is tightly controlled. Exposure is most likely on Windows endpoints running legacy Avaya IP Office Phone Manager, IP Softphone, or related Avaya IP Office client products. The bundle does not identify exact versions or CPEs, so inventory must be based on installed software and vendor advisory details. Treat this as a legacy credential exposure issue. It is not evidenced as actively exploited in the supplied sources, but cleartext voice-system credentials can support impersonation and internal fraud. Prioritize if legacy Avaya clients are still deployed or endpoints are shared, unmanaged, or remotely accessible. Mitigation focus: Review Avaya ASA-2005-041 and apply vendor-recommended updates or configuration changes.; Inventory endpoints for Avaya IP Office Phone Manager and IP Softphone installations.; Rotate credentials that may have been stored by affected clients..

Prepared

Jun 30, 2026, 00:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.