HIGH🇬🇧 English

CVE-2021-40845

CVSS 8.8v3.1pub. 2021-09-15upd. 2024-11-21

The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Zenitel Alphacom Xe Audio Server

    APP
    Zenitel
    ≤ 11.2.3.10
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2025-59818CRITICAL10.0PL ✓ten sam vendor

Command Injection w Zenitel Tcis-3 via nazwa przesyłanego pliku

CVE-2025-64090CRITICAL10.0PL ✓ten sam vendor

Command injection w Zenitel TCIS-3 – wykonanie poleceń przez hostname

CVE-2025-64093CRITICAL10.0PL ✓ten sam vendor

RCE poprzez command injection w polu hostname urządzeń Zenitel ICx500/ICx510

CVE-2025-64091HIGH8.6ten sam vendor

This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.

CVE-2025-64092HIGH7.5ten sam vendor

This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and d...