CVE-2023-48166 is a high severity (CVSS 7.5) path traversal in the SOAP server of Atos Unify OpenScape Voice V10. An unauthenticated attacker could read arbitrary files on the system. Update to V10R3.26.1 or later, the first fixed release named by the researcher and the record.
What's affected
The NVD record says a directory traversal flaw in the SOAP Server integrated in Atos Unify OpenScape Voice V10 before V10R3.26.1 lets a remote attacker view the contents of arbitrary files in the local file system. An unauthenticated attacker might obtain sensitive files that allow compromise of the underlying system. The weakness is CWE-22 (Path Traversal).
The record scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The researcher's advisory at INTEGRITY Labs, published on 12 January 2024, scores it 7.4 with the vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, which assumes an adjacent network position and a changed scope. Both are High, but the reachability assumption differs, so the severity depends on how your voice network is segmented.
The researcher's timeline says the bug was reported to Unify on 2 November 2023, verified and fixed by the vendor on 19 December 2023, and disclosed on 12 January 2024. Their solution is to update to V10R3.26.1 or later. The vendor advisory is OBSO-2401-01, a PDF that I could not read through my fetch, so confirm details there. The record does not flag the CVE as exploited in the wild.
How to check if you're exposed
OpenScape Voice is a telephony platform, so version information comes from the platform's own administration tools and from your integrator. Ask whoever manages the platform for the exact build and compare it with V10R3.26.1.
If you cannot get the version quickly, assume any V10 build older than V10R3.26.1 is affected. Note that the record's product entry lists V10 only, so other major versions are not covered by this CVE, but the vendor advisory should be your authority.
Also check network exposure. The SOAP server should not be reachable from user networks or from the internet. Review firewall rules for the management and SOAP interfaces of the voice servers.
What to do now
- Update OpenScape Voice to V10R3.26.1 or later, following the instructions from Unify and your support contract.
- Read the vendor advisory OBSO-2401-01 for any extra steps or hotfix conditions.
- Restrict network access to the SOAP interface to the management systems that need it.
- Review the files an attacker could read, such as configuration files and credentials stored on the server, and rotate any secrets stored there if you suspect exposure.
- Check access logs for unusual requests to the SOAP server.
Why it matters
A path traversal flaw lets a request escape the folder the service means to serve files from. The server then reads a file it was never supposed to hand out. On a telephony platform the files nearby can include configuration data and credentials, which is why a read only flaw still scores high for confidentiality.
Infrastructure software like this often sits outside the normal developer patching flow. It is owned by a telecoms or network team, upgraded on a schedule and rarely scanned. Putting such systems into the same inventory as application dependencies means advisories reach the right owner. See the Safeguard Gold page for this CVE for the record.
Quick check
Which version fixes CVE-2023-48166?
The researcher advisory and the NVD record both give V10R3.26.1, so V10 builds before that are affected.
Why do the sources give different scores?
The record says 7.5. The researcher scored it 7.4 with an adjacent network vector and a changed scope. Both are High severity.
Sources
- INTEGRITY Labs advisory for CVE-2023-48166
- Unify advisory OBSO-2401-01 (PDF, could not be read by our fetch)
- NVD record for CVE-2023-48166
Last reviewed: 19 October 2026.
