Security readout for executives and security teams
Plain-English summary
CVE-2021-37462 is a reflected cross-site scripting issue in NCH Axon PBX v2.22 and earlier. A crafted request to the IP blacklist page could cause a victim’s browser to run attacker-controlled script. Business risk depends on who can reach that PBX web interface and whether administrators can be lured to malicious links.
Executive priority
Prioritize based on exposure. Internet-facing or broadly reachable PBX administration portals should be addressed promptly because administrator browser compromise could affect telephony operations. Internal-only, tightly restricted deployments are lower urgency but still need upgrade or containment planning.
Technical view
The reported vector is reflected XSS via the /ipblacklist errorip parameter in NCH Axon PBX v2.22 and earlier. The public record does not provide CVSS, CWE, authentication requirements, or vendor-fixed version details. A public PoC reference exists, but the provided sources do not establish active exploitation.
Likely exposure
Exposure is most likely where NCH Axon PBX v2.22 or earlier is still deployed and its web interface is reachable by administrators or untrusted networks. The supplied affected metadata is sparse, so inventory confirmation is required.
Exploitation context
The source bundle includes a public GitHub PoC reference, but CISA KEV is false and no cited source claims active exploitation. Treat this as a plausible social-engineering or admin-session risk rather than confirmed mass exploitation.
Researcher notes
Evidence is limited. The CVE description identifies product, version ceiling, endpoint, and reflected parameter, but lacks CVSS, CWE, authentication context, and official remediation details. Do not assume affected CPEs or patch availability beyond vendor guidance.
Mitigation direction
- Identify any NCH Axon PBX deployments and confirm exact versions.
- Check NCH vendor guidance for a fixed or supported release path.
- Restrict PBX web administration access to trusted networks or VPN users.
- Decommission or replace unsupported Axon PBX versions where upgrades are unavailable.
- Monitor for suspicious requests targeting the IP blacklist page.
Validation and detection
- Inventory PBX hosts and verify whether Axon PBX is version 2.22 or earlier.
- Confirm the PBX web interface is not exposed to untrusted networks.
- Review web logs for unusual requests to /ipblacklist with errorip parameters.
- After remediation, verify reflected parameter output is safely encoded.
- Document whether compensating network controls are in place.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-37462 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nch.com.au/pbx/index.htmlCVE reference · x_refsource_MISC
- https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.