Ok so an Nmap scan against an IP address shows that port 5060 is open. I know that 5060 indicates that this is SIP traffic. Also, 5060 indiciates that this is unencrypted traffic, where if the port was 5061, then the traffic would be encrypted.
I also have a hunch that 5060 tunnels through to a PBX based phone system (possibly Asterisk). I think that the router is listening on 5060 and forwarding any inbound traffic pointed at port 5060 at this IP address to this Linux based phone system for the purpose of receiving calls.
Calls made come out through port 5060 at this IP address.
What problems would this setup cause from a security point of view? How could an attacker take advantage of this information.