Security in telephony: patches, CVEs and advisories
Telephony is IT too. So it needs patching too.
SBCs, phone systems, desk phones, meeting room equipment and contact center platforms regularly get security updates. In practice they often fall between two stools: IT looks after laptops and servers, the telephony vendor after outages.
A vulnerability in your telephony can lead to eavesdropping, abuse of your lines or access to your network.
It happens more often than you think.
Cisco Unified CM
January 2026: a critical vulnerability that let attackers run code without logging in. Added to the list of actively exploited vulnerabilities the same day.
Cisco’s advisory →HP Poly VVX and Trio
June 2026: a critical vulnerability in the phone software (CVE-2026-0826). The fix: update the firmware.
HP’s bulletin →AudioCodes Mediant
February 2025: passwords in a configuration export turned out to be decryptable (CVE-2024-52884). So also watch who can see your backups.
The advisory →FreePBX
August 2025: a critical vulnerability in the admin interface, on the list of actively exploited vulnerabilities within a day.
The advisory →And in 2023 the 3CX app itself was infected through its supplier: a supply-chain attack.
Five weak spots.
- Default passwordsAdmin accounts still on the password from the box.
- Management open to the internetThe admin interface of an SBC or phone system is reachable from outside.
- Old firmwareUpdates that exist but were never installed.
- Unsupported devicesTeams phones on Android 9 have not been supported since August 2025.
- Toll fraudIntruders call expensive international numbers through your phone system. You pay the bill.
The Dutch Cybersecurity Act applies since 15 August 2026.
The Cyberbeveiligingswet (Cbw) is the Dutch implementation of NIS2. Organisations that fall under it must register with the NCSC, take appropriate measures and report incidents. Supply-chain security is part of that, and so is your telephony and the vendors that manage it.
Whether you fall under it is something you assess yourself, based on the sectors and the size of your organisation.
Your intercom, access control and lift emergency phone too. They are increasingly connected to your network, and Europe sets requirements for them. Since 1 August 2025, new wireless devices with an internet connection must meet the cybersecurity requirements of the Radio Equipment Directive. Under the Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities from 11 September 2026. From 11 December 2027 the full requirements apply, such as security updates during the support period.
So when you buy, ask how long the manufacturer will provide updates, and put these devices on your list too.
Five agreements for security follow-up.
- OverviewKnow which SBCs, phone systems, devices, intercoms and platforms you have, with version and vendor.
- OwnerAgree who follows the advisories and who patches: you, your IT partner or your vendor.
- SourcesFollow your vendors’ security pages, CISA’s list of actively exploited vulnerabilities and the NCSC advisories.
- RhythmCheck every month. For a vulnerability that’s actively exploited, within a few days.
- LifecycleReplace devices before support ends.
The checklist as a PDF.
Seven questions to take to your meeting or pass on to a colleague. Enter your name and email address and the PDF opens right away.
We only use your details to give you the checklist and, at most, to ask you once whether it helped. Read more in our privacy statement.
We find out where the risk is.
We map which telephony and UC you have, who keeps it up to date and where the risk is. Independent, and we also guide you through follow-up and management.