Vulnerability Description
FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sangoma | Restapps | 15.0.19.87 |
| Sangoma | Freepbx | - |
| Sangoma | Pbxact | - |
References
- https://community.freepbx.org/t/0-day-freepbx-exploit/80092ExploitIssue TrackingVendor Advisory
- https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/801Vendor Advisory
- https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+PhoneVendor Advisory
- https://community.freepbx.org/t/0-day-freepbx-exploit/80092ExploitIssue TrackingVendor Advisory
- https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/801Vendor Advisory
- https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+PhoneVendor Advisory
FAQ
What is CVE-2021-45461?
CVE-2021-45461 is a vulnerability with a CVSS score of 9.8 (CRITICAL). FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 202...
How severe is CVE-2021-45461?
CVE-2021-45461 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-45461?
Check the references section above for vendor advisories and patch information. Affected products include: Sangoma Restapps, Sangoma Freepbx, Sangoma Pbxact.