CVE-2021-45966: Pascom Cloud Phone System

Critical severity, CVSS 9.8. EPSS: 6% chance of exploitation in the next 30 days.

An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters.

Affected products

• Pascom Cloud Phone System: up to and including 7.19

Published 2022-03-18. Last modified 2026-06-17.