CVE-2021-45461

FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

21.66% chance of exploitation in the next 30 days, 97th percentile

Published

2021-12-22

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://community.freepbx.org/t/0-day-freepbx-exploit/80092

References

• CVE Record
• NVD entry

Related

• CVE-2021-45459
• CVE-2021-45464
• CVE-2021-45429
• CVE-2021-45466
• CVE-2021-45428
• CVE-2021-45467