How severe is CVE-2021-45461?

CVE-2021-45461 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-45461 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 22% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-45461?

CVE-2021-45461 primarily affects Sangoma Restapps. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-45461?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2021-45461 published?

CVE-2021-45461 was published on 2021-12-22 and last updated on 2026-06-17.

CVE-2021-45461

CVE-2021-45461 is a critical-severity vulnerability in Sangoma Restapps with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 22% places it in the 97th percentile, indicating an elevated likelihood of exploitation.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 22% (97th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Sangoma Restapps
Published: 2021-12-22
Last modified: 2026-06-17

Description

FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.

Frequently asked questions

What is CVE-2021-45461?: FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.
How severe is CVE-2021-45461?: CVE-2021-45461 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-45461 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 22% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-45461?: CVE-2021-45461 primarily affects Sangoma Restapps. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-45461?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2021-45461 published?: CVE-2021-45461 was published on 2021-12-22 and last updated on 2026-06-17.

References

Affected products (4)

cpe:2.3:a:sangoma:restapps:15.0.19.87:*:*:*:*:*:*:*
cpe:2.3:a:sangoma:restapps:15.0.19.88:*:*:*:*:*:*:*
cpe:2.3:a:sangoma:restapps:16.0.18.40:*:*:*:*:*:*:*
cpe:2.3:a:sangoma:restapps:16.0.18.41:*:*:*:*:*:*:*

More vulnerabilities in Sangoma Restapps

CVE-2020-10666 — Critical (CVSS 9.8): The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote…

All CVEs affecting Sangoma Restapps →