PT-2021-22977 · Zenitel · Zenitel Alphacom Xe Audio Server

Ricardo J. Ruiz Fernández · Published 2021-09-12 · Updated 2021-09-27 · CVE-2021-40845

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zenitel AlphaCom XE Audio Server versions through 11.2.3.10

Description The web part of Zenitel AlphaCom XE Audio Server, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at "php/index.php". Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.

Recommendations For versions through 11.2.3.10, consider restricting access to the Custom Scripts section at "php/index.php" to minimize the risk of exploitation. As a temporary workaround, consider disabling the execution of PHP code under the /cmd directory until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-40845

Affected Products

Zenitel Alphacom Xe Audio Server

References · 10

• 🔥 https://github.com/ricardojoserf/CVE-2021-40845 · Exploit
• 🔥 https://ricardojoserf.github.io/CVE-2021-40845 · Exploit
• 🔥 http://packetstormsecurity.com/files/164160/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-40845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40845 · Security Note
• http://packetstormsecurity.com/files/164149/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html · Note
• https://t.me/cybersecuritytechnologies/4278 · Telegram Post
• https://t.me/cvenotify/20887 · Telegram Post
• https://t.me/defcon_news/85132 · Telegram Post
• https://t.me/cibsecurity/28881 · Telegram Post