PatchTheCVEnch vulnerabilities
Recent CVEs affecting nch products. 8 tracked.
nch has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2021-07-25. Highest priority: CVE-2021-37441 (score 54/100).
- CVE-2021-37469 MEDIUM 6.5 UPGRADE In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.
- CVE-2021-37468 LOW 3.3 UPGRADE NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configur
- CVE-2021-37452 MEDIUM 5.5 UPGRADE NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by r
- CVE-2021-37441 HIGH 8.8 UPGRADE NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.
- CVE-2021-37440 MEDIUM 6.5 UPGRADE NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.
- CVE-2021-37439 MEDIUM 6.5 UPGRADE NCH FlexiServer v6.00 suffers from a syslog?file=/.
- CVE-2018-11552 MEDIUM 6.1 DOWNGRADE There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field
- CVE-2018-11551 HIGH 7.8 DOWNGRADE AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to e
FAQ
How do I fix nch vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nch being exploited right now?
None of the tracked nch CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nch CVE should I patch first?
CVE-2021-37441 currently ranks highest (54/100): NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/..