PatchTheCVE: sl2100 firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2021-20677: UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERhttps://patchthecve.com/cve/CVE-2021-20677.htmlhttps://patchthecve.com/cve/CVE-2021-20677.htmlWed, 17 Jun 2026 03:34:13 +0000LOW 3.1: UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially craftedCVE-2019-20032: An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derivhttps://patchthecve.com/cve/CVE-2019-20032.htmlhttps://patchthecve.com/cve/CVE-2019-20032.htmlWed, 17 Jun 2026 02:29:52 +0000MEDIUM 6.5: An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem.CVE-2019-20029: An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXhttps://patchthecve.com/cve/CVE-2019-20029.htmlhttps://patchthecve.com/cve/CVE-2019-20029.htmlWed, 17 Jun 2026 02:29:52 +0000HIGH 8.8: An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially crafted HTTP POST can cause privilege escalation resulting in a higher privileged account, including an uCVE-2019-20028: Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL210https://patchthecve.com/cve/CVE-2019-20028.htmlhttps://patchthecve.com/cve/CVE-2019-20028.htmlWed, 17 Jun 2026 02:29:52 +0000HIGH 7.5: Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice response system content through a system's WebPro administration interface.CVE-2019-20027: Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higherhttps://patchthecve.com/cve/CVE-2019-20027.htmlhttps://patchthecve.com/cve/CVE-2019-20027.htmlWed, 17 Jun 2026 02:29:52 +0000CRITICAL 9.8: Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid, successfully authenticating account.