High severity · published Sep 15, 2021
CVE-2021-40845
The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php
8.8
CVSS
4.7%
EPSS
No
On KEV
Description
The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AX
Alphacom XE Audio Server · Zenitel
through 11.2.3.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40845
Third Party Advisory
http://packetstormsecurity.com/files/164149/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html
Exploit
http://packetstormsecurity.com/files/164160/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html
Exploit
https://github.com/ricardojoserf/CVE-2021-40845
Exploit
https://ricardojoserf.github.io/CVE-2021-40845/
More from Alphacom XE Audio Server
6.5
CVE-2025-59819
Authenticated Arbitrary File Read via filepath parameter