Security readout for executives and security teams
Plain-English summary
CVE-2021-37460 is a reported reflected cross-site scripting issue in NCH Axon PBX v2.22 and earlier. If a user can be lured into a crafted PBX web link, script may run in that user's browser context. Source data does not provide CVSS, authentication details, or a vendor fix.
Executive priority
Prioritize validation if NCH Axon PBX is present, because PBX administration is operationally sensitive. Urgency depends on exposure and vendor guidance, both incomplete in the provided sources. Internet-facing or broadly reachable instances should be reviewed first.
Technical view
The CVE describes reflected XSS through the /planprop id parameter in NCH Axon PBX v2.22 and earlier. Public references include the vendor product page and a proof-of-concept write-up. The record lacks structured affected CPEs, CVSS metrics, CWE mapping, and remediation details.
Likely exposure
Exposure is most relevant where NCH Axon PBX web management or related pages are reachable by users, especially from the internet. The provided data does not confirm whether authentication is required or which deployment configurations expose /planprop.
Exploitation context
The source bundle includes a public proof-of-concept reference, but no CISA KEV listing and no cited evidence of active exploitation. Treat exploitability as plausible for vulnerable reachable deployments, not as confirmed in-the-wild activity.
Researcher notes
Key gaps are severity scoring, authentication requirements, affected CPEs, and remediation status. The GitHub reference suggests reproducibility, but analysis should avoid assuming impact beyond reflected XSS until tested in an authorized environment or confirmed by vendor documentation.
Mitigation direction
- Identify any NCH Axon PBX deployments and confirm version 2.22 or earlier.
- Check NCH guidance and update or retire affected instances if a supported release exists.
- Restrict PBX web access to trusted networks and authenticated users.
- Review web logs for unusual /planprop requests involving the id parameter.
- Warn administrators not to follow unsolicited PBX management links.
Validation and detection
- Inventory PBX hosts and map exposed web management interfaces.
- Confirm product name and version from approved administrative sources.
- Review access logs for /planprop activity around user reports or alerts.
- Verify whether NCH has published current upgrade or mitigation guidance.
- Check whether compensating controls limit external access to the PBX web UI.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-37460 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nch.com.au/pbx/index.htmlCVE reference · x_refsource_MISC
- https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.