CVE-2021-45461

FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.

• https://community.freepbx.org/t/0-day-freepbx-exploit/80092Exploit, Issue Tracking, Vendor Advisory
• https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109Vendor Advisory
• https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCEVendor Advisory
• https://community.freepbx.org/t/0-day-freepbx-exploit/80092Exploit, Issue Tracking, Vendor Advisory
• https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109Vendor Advisory
• https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCEVendor Advisory

Published

Dec 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-45454Ampere Altra before SRP 1.08b and Altra Max​ before SRP 2.05…7.5
• CVE-2021-45456Apache kylin checks the legitimacy of the project before exe…9.8
• CVE-2021-45457In Apache Kylin, Cross-origin requests with credentials are …7.5
• CVE-2021-45458Apache Kylin provides encryption classes PasswordPlaceholder…7.5
• CVE-2021-45459lib/cmd.js in the node-windows package before 1.0.0-beta.6 f…9.8
• CVE-2021-45460A vulnerability has been identified in SICAM PQ Analyzer (Al…8.1
• CVE-2021-45462In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/U…7.5
• CVE-2021-45463load_cache in GEGL before 0.4.34 allows shell expansion when…7.8
• CVE-2021-45464kvmtool through 39181fc allows an out-of-bounds write, relat…8.8
• CVE-2021-45465A vulnerability has been identified in syngo fastView (All v…7.8
• CVE-2021-45466In CWP (aka Control Web Panel or CentOS Web Panel) before 0.…9.8
• CVE-2021-45467In CWP (aka Control Web Panel or CentOS Web Panel) before 0.…9.8