CVE-2021-40856

What it actually does

This vulnerability is an unauthenticated, network-accessible authentication bypass in Auerswald COMfortel IP phone web interfaces. A crafted HTTP request containing the substring `/about/../` can cause the device to mishandle access-control checks and allow access to resources that should require authentication. The primary technical impact is unauthorized disclosure of sensitive device information or configuration data; the CVSS vector indicates high confidentiality impact with no direct integrity or availability impact.

Why it matters to the business

An attacker who can reach the management interface of an affected COMfortel IP phone may be able to obtain sensitive configuration or operational information without credentials. In a business telephony environment, this can expose VoIP infrastructure details, extensions, network configuration, and potentially information useful for deeper intrusion, toll fraud, impersonation, or reconnaissance. The issue is older but has weaponized exploitation maturity and a high EPSS score, so internet-exposed or broadly reachable devices should be treated as high priority even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed Auerswald COMfortel IP phone web interface, commonly by scanning for HTTP or HTTPS management services and device-specific web banners. The attacker then sends crafted HTTP requests to protected web resources using a path that includes `/about/../`. If the device is running vulnerable firmware, the web server or application access-control logic treats the request as permitted while resolving the path to a restricted resource. The attacker can then retrieve sensitive information without logging in. The disclosed information may be used to map the VoIP environment, identify firmware versions, gather configuration details, and plan follow-on attacks against telephony infrastructure or adjacent network services.

How to fix it

Upgrade affected Auerswald COMfortel IP phone firmware to a fixed release. The public description identifies versions before 2.8G as affected for COMfortel 1400 IP and 2600 IP, so deploy firmware 2.8G or later where available and verify the vendor’s current advisory for each model, including COMfortel 3600 IP where present in inventories. If immediate firmware upgrade is not possible, restrict access to the device web management interface to trusted administrative networks only, block internet exposure, require VPN or management jump-host access, and apply firewall or reverse-proxy rules that deny requests containing `/about/../`. Disable unnecessary web management access where operationally feasible.

How to confirm the fix worked

Confirm each device model and firmware version from the local device interface or centralized asset inventory and verify it is running a non-vulnerable firmware release, preferably 2.8G or later where applicable. From a controlled test host, attempt an unauthenticated request containing `/about/../` to a resource that should require login and confirm the device returns an authentication challenge, redirect to login, or access denied response rather than protected content. Validate that management interfaces are not reachable from untrusted networks or the public internet. Review firewall, NAC, and vulnerability scanner results to confirm no affected COMfortel web interfaces remain exposed.

Typical attack path

1. Scan networks or the internet for Auerswald COMfortel IP phone web management interfaces.
2. Fingerprint the device model and firmware version where possible.
3. Send unauthenticated HTTP or HTTPS requests containing the `/about/../` substring to access protected resources.
4. Review returned pages or files for sensitive configuration, version, network, or telephony information.
5. Use the exposed information for reconnaissance, credential attacks, VoIP abuse, or lateral movement planning.

How to detect it

Investigate whether affected phone web interfaces received unauthenticated requests containing `/about/../`, especially requests returning HTTP 200 responses or unusually large response sizes. Useful log sources include device web access logs if available, reverse-proxy logs, firewall and VPN logs, IDS/IPS alerts, NetFlow records, web proxy logs, and vulnerability scanner output. Search for external or unexpected internal source IPs accessing Auerswald phone management ports over HTTP or HTTPS, followed by repeated requests to administrative or configuration paths. Correlate suspicious requests with successful responses, device logins, configuration exports, firmware information pages, or subsequent VoIP management activity. Because many embedded phones have limited local logging, network telemetry may be the most reliable evidence source. If exploitation is suspected, preserve device configuration, collect packet captures where available, review call-management and SIP infrastructure logs for follow-on abuse, and compare current device configuration against known-good backups.

• /about/../
• GET /about/../
• POST /about/../
• %2Fabout%2F..%2F
• /about/%2e%2e/
• /about/..%2f
• HTTP requests to Auerswald COMfortel management interfaces containing /about/../

What your security team should do

• Immediately identify Auerswald COMfortel 1400 IP, 2600 IP, and 3600 IP devices and record firmware versions and management exposure.
• Prioritize remediation for any device with a web interface reachable from the internet, guest networks, user VLANs, or other untrusted segments.
• Upgrade affected devices to vendor-fixed firmware, using 2.8G or later where applicable and confirming model-specific guidance from Auerswald.
• Restrict device management interfaces to dedicated administrative networks and block direct internet access.
• Add web filtering, WAF, IDS, or reverse-proxy rules to alert on or block HTTP requests containing `/about/../` to phone management interfaces.
• Review historical HTTP access logs, firewall logs, proxy logs, and IDS telemetry for exploitation attempts or successful unauthenticated access.
• If suspicious access is found, rotate related administrative credentials, review VoIP configuration for unauthorized changes, and assess whether exposed configuration data could enable follow-on compromise.