CVE-2021-45461

CRITICAL

9.8

Description

FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/22/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

sangoma:freepbxsangoma:pbxactsangoma:restapps

References

https://community.freepbx.org/t/0-day-freepbx-exploit/80092(cve@mitre.org)

https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109(cve@mitre.org)

https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE(cve@mitre.org)

https://community.freepbx.org/t/0-day-freepbx-exploit/80092(af854a3a-2127-422b-91ae-364da2661108)

https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109(af854a3a-2127-422b-91ae-364da2661108)

https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.