What’s Vulnerable › Vulnerabilities

CVE-2021-45461

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 21.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-22 · updated 2026-06-17

Description

FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.

Affected products

• FreePBX restapps: 15.0.19.87, 15.0.19.88, 16.0.18.40, 16.0.18.41

References

• https://community.freepbx.org/t/0-day-freepbx-exploit/80092
• https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109
• https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE
• https://community.freepbx.org/t/0-day-freepbx-exploit/80092
• https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109
• https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE

Get alerted when CVE-2021-45461 or the next vulnerability affects your stack