Security readout for executives and security teams
Plain-English summary
NCH Axon PBX 2.22 and earlier is reported to allow unauthorized file disclosure through a path traversal weakness. In business terms, a vulnerable PBX web interface could expose local files that may contain operational or sensitive information. The sources do not provide CVSS, patch details, or confirmed real-world exploitation.
Executive priority
Prioritize externally reachable PBX systems first. This is not KEV-listed and severity is unspecified, but PBX systems are sensitive infrastructure and file disclosure can expose configuration or operational data. Require inventory, exposure reduction, and vendor remediation review.
Technical view
The CVE describes path traversal in NCH Axon PBX 2.22 and earlier, involving a file-selection parameter on a log-related endpoint. The reported impact is local file disclosure. The public bundle does not state authentication requirements, reachable file scope, operating system constraints, or a vendor-fixed version.
Likely exposure
Exposure is most likely where NCH Axon PBX 2.22 or earlier is installed and its web interface is reachable by untrusted users. Internet-facing PBX administration or log interfaces would increase urgency. The bundle does not identify CPEs or broader affected products.
Exploitation context
The source bundle includes a public GitHub proof-of-concept reference, but CISA KEV status is false and no cited source confirms active exploitation. Treat this as publicly documented but not source-confirmed as exploited in the wild.
Researcher notes
The public record is sparse: no CVSS, CWE, authentication context, fixed version, or detailed vendor advisory is included. Analysis should stay limited to NCH Axon PBX 2.22 and earlier and the documented file disclosure impact until additional vendor evidence is available.
Mitigation direction
- Inventory NCH Axon PBX deployments and confirm whether versions are 2.22 or earlier.
- Check NCH vendor guidance or support channels for fixed versions or recommended remediation.
- Restrict PBX web administration access to trusted networks or VPN-only access.
- Monitor PBX web logs for traversal-like requests against log or file parameters.
- Retire or isolate unsupported deployments if no vendor-supported fix is available.
Validation and detection
- Confirm the installed Axon PBX version on each PBX server.
- Verify the PBX web interface is not exposed to the public internet.
- Review access logs for suspicious requests targeting log-related file parameters.
- Confirm any upgrade or vendor remediation is documented and applied.
- Record compensating controls for systems that cannot be upgraded immediately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
File access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-37440 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.mdCVE reference · x_refsource_MISC
- https://www.nch.com.au/pbx/index.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.