CVE-2021-40845

🗓️ 15 Sep 2021 12:39:43Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 103 Views🌐 WEB

Zenitel AlphaCom XE Audio Server through 11.2.3.10 file upload vulnerabilit

Reporter	Title	Published	Views	Family All 13
0day.today	Zenitel AlphaCom XE Audio Server 11.2.3.10 Shell Upload Vulnerability	15 Sep 202100:00	–	zdt
0day.today	AlphaWeb XE - File Upload Remote Code Execution (Authenticated) Exploit	15 Sep 202100:00	–	zdt
ATTACKERKB	CVE-2021-40845	15 Sep 202113:15	–	attackerkb
Circl	CVE-2021-40845	12 Sep 202113:30	–	circl
CNNVD	Zenitel AlphaCom XE Audio Server 代码问题漏洞	14 Sep 202100:00	–	cnnvd
Cvelist	CVE-2021-40845	15 Sep 202112:39	–	cvelist
Exploit DB	AlphaWeb XE - File Upload Remote Code Execution (RCE) (Authenticated)	15 Sep 202100:00	–	exploitdb
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Zenitel Alphacom_Xe_Audio_Server	10 Sep 202110:23	–	githubexploit
NVD	CVE-2021-40845	15 Sep 202113:15	–	nvd
OSV	CVE-2021-40845	15 Sep 202113:15	–	osv

NVD

Node

zenitel alphacom_xe_audio_serverRange≤11.2.3.10

Source	Link
github	www.github.com/ricardojoserf/CVE-2021-40845
packetstormsecurity	www.packetstormsecurity.com/files/164160/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html
packetstormsecurity	www.packetstormsecurity.com/files/164149/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html
ricardojoserf	www.ricardojoserf.github.io/CVE-2021-40845/

Parameter	Position	Path	Description	CWE
userfile	request body	php/script_uploads.php	Authenticated insecure file upload leading to RCE via uploaded PHP in /cmd directory.	CWE-434
cmd	query param	cmd/poc.php	Execution of uploaded PHP file via /cmd/<file>?cmd=<command> to achieve RCE.	CWE-434

17 Jun 2026 04:07Current

8.8High risk

Vulners AI Score8.8

CVSS 26.5

CVSS 3.18.8

EPSS0.04682

zenitel alphacom xe audio server cve-2021-40845 file upload vulnerability security php code_execution