CVE-2021-40845: The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict f...

Security readout for executives and security teams

AlphaWeb XE, the web component of Zenitel AlphaCom XE Audio Server, allowed unsafe file uploads in its Custom Scripts area. Sources say uploaded PHP could run from the /cmd directory. For organizations using affected intercom/audio server systems, this could let an attacker with access to that web function run server-side code. Exposure is most likely where AlphaWeb XE is enabled and reachable on Zenitel AlphaCom XE Audio Server versions through 11.2.3.10. Internet-exposed management interfaces are higher concern. The provided sources do not state whether authentication or a specific role is required to reach Custom Scripts. Prioritize review if Zenitel AlphaCom XE supports physical security, emergency communications, or operational facilities. The issue can enable code execution, but urgency depends on whether the web interface is reachable and who can access Custom Scripts. Mitigation focus: Identify AlphaCom XE Audio Server deployments and AlphaWeb XE exposure.; Check Zenitel guidance for fixed versions or official mitigations.; Remove AlphaWeb XE management access from the public internet..

Prepared

Jun 2, 2026, 18:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.