Z6 Mag posted an article describing a pretty old vulnerability in the code of Avaya’s H323 phones. The issue allows a remote code execution, that can be used by a hacker to extract the audio from the speakerphone.

Avaya has been aware of that issue for a while and offers a new software for the phone: https://downloads.avaya.com/css/P8/documents/101059945

If you need help to update your phones you can contact me.

Another article posted on Bleeping Computer describing the same issue: https://www.bleepingcomputer.com/news/security/avaya-voip-phones-harbored-10-year-old-vulnerability/