CVEvulnerability

CVE-2021-45461

9.8 CRITICAL Published 2021-12-22 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2021-12-22
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.

Affected configurations

• sangoma restapps 15.0.19.87 • sangoma restapps 15.0.19.88 • sangoma restapps 16.0.18.40 • sangoma restapps 16.0.18.41

References

https://community.freepbx.org/t/0-day-freepbx-exploit/80092 Exploit, Issue Tracking, Vendor Advisory
https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109 Vendor Advisory
https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE Vendor Advisory
https://community.freepbx.org/t/0-day-freepbx-exploit/80092 Exploit, Issue Tracking, Vendor Advisory
https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109 Vendor Advisory
https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE Vendor Advisory