What’s Vulnerable › Vulnerabilities

CVE-2021-45490

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-28 · updated 2026-06-17
• Weakness: CWE-295

Description

The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation.

Affected products

• 3CX: through 18.0.4; through 18.0.11; through 2022-03-17

References

• https://packetstormsecurity.com/files/166376/3CX-Client-Missing-TLS-Validation.html
• https://www.3cx.com/community/forums/posts-articles-news/
• https://packetstormsecurity.com/files/166376/3CX-Client-Missing-TLS-Validation.html
• https://www.3cx.com/community/forums/posts-articles-news/

Get alerted when CVE-2021-45490 or the next vulnerability affects your stack