Security readout for executives and security teams
Plain-English summary
CVE-2021-37461 is a reflected cross-site scripting issue in NCH Axon PBX v2.22 and earlier. A crafted link to a specific web endpoint could make a user's browser run attacker-controlled script if the user opens it. Business risk depends on who can reach the PBX web interface and user privileges.
Executive priority
Treat as a medium-priority exposure review, not an emergency based on current evidence. Prioritize faster if the PBX web interface is internet-facing, used by privileged staff, or lacks compensating access controls.
Technical view
The CVE description identifies reflected XSS in the /extensionsinstruction?id= parameter of NCH Axon PBX v2.22 and earlier. Public references include the vendor product page and a GitHub proof-of-concept write-up. No CVSS score, CWE mapping, vendor advisory, fixed version, or mitigation details are provided in the source bundle.
Likely exposure
Exposure is most likely where NCH Axon PBX v2.22 or earlier exposes its web interface to users or the internet. Systems limited to trusted internal administration paths have lower practical exposure, but phishing-assisted exploitation remains plausible.
Exploitation context
The source bundle cites a public proof-of-concept reference, but CISA KEV status is false and no cited source states active exploitation. The known issue is reflected XSS, so exploitation likely requires a target user to interact with a crafted URL.
Researcher notes
Evidence is sparse: the CVE record gives endpoint and affected version, while the referenced GitHub page indicates public PoC availability. The bundle does not provide CVSS, root cause detail, affected CPEs, patch status, or confirmed exploitation.
Mitigation direction
- Identify any NCH Axon PBX deployments and confirm deployed versions.
- Check NCH guidance for fixed or supported versions before changing production systems.
- Apply vendor updates if a fixed version is available for your deployment.
- Restrict PBX web interface access to trusted networks or VPN users.
- Use browser and gateway controls to reduce exposure to suspicious links.
Validation and detection
- Inventory PBX hosts and confirm whether Axon PBX v2.22 or earlier is present.
- Review web access logs for unusual requests to /extensionsinstruction with id parameters.
- Confirm the PBX web interface is not internet-exposed unless required.
- Validate any vendor update or compensating control in staging first.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-37461 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nch.com.au/pbx/index.htmlCVE reference · x_refsource_MISC
- https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.