CVE-2021-40859

What it actually does

This vulnerability is an authentication bypass caused by backdoor access in Auerswald COMpact 5500R firmware versions 7.8A and 8.0B. An unauthenticated network attacker who can reach the web-based management interface can obtain full administrative control of the PBX device. Because the management application controls telephony configuration, extensions, trunks, routing, voicemail, firmware, and administrative users, successful exploitation can compromise confidentiality, integrity, and availability of the device and the telephone services it supports.

Why it matters to the business

Compromise of a vulnerable PBX can disrupt business phone service, expose call records and configuration data, enable toll fraud through unauthorized outbound calling, allow interception or redirection of calls, and provide a foothold into voice or management networks. The high CVSS score, high EPSS likelihood, and weaponized exploit maturity make this an urgent exposure even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an Internet-facing or internally reachable Auerswald COMpact 5500R web management interface. If the device is running affected firmware, the attacker abuses the embedded backdoor behavior to bypass normal authentication and gain administrative access without valid credentials. From the management console, the attacker can create or modify administrator accounts, alter SIP trunk and extension settings, enable call forwarding, change dial plans, review call logs, export configuration data, disrupt service, or stage further persistence by modifying device configuration. In a fraud-focused scenario, the attacker may configure premium-rate or international calling routes; in an espionage scenario, they may monitor or redirect calls; in an availability-focused scenario, they may disable trunks, extensions, or device services.

How to fix it

Upgrade affected Auerswald COMpact 5500R devices running firmware 7.8A or 8.0B to a vendor-supported firmware version that removes the backdoor behavior. No fixed version was provided in the input, so security teams should verify the current Auerswald advisory and obtain firmware directly from the vendor or an authorized support channel. Until upgraded, remove Internet exposure of the management interface, restrict access to trusted administrative networks or VPNs, block access at firewalls, disable unnecessary remote administration, rotate all PBX administrative credentials after patching, and review telephony configuration for unauthorized changes. If compromise is suspected, export evidence before changes, rebuild from a trusted firmware image, and reapply known-good configuration rather than relying only on password changes.

How to confirm the fix worked

Confirm every COMpact 5500R device is no longer running firmware 7.8A or 8.0B. Validate that the web-based management interface is not reachable from untrusted networks and is restricted by firewall, VPN, or management VLAN controls. Attempt authentication testing from an untrusted network segment to confirm administrative access is not possible without valid credentials. Review the device administration page for unexpected users, remote access options, SIP trunks, call forwarding rules, dial plans, and configuration export settings. After upgrade, confirm the installed firmware version in the device UI or inventory system and retain evidence of the upgrade for audit purposes.

Typical attack path

1. Scan for Auerswald COMpact 5500R devices exposing the web-based management interface.
2. Fingerprint firmware or device banners to identify versions 7.8A or 8.0B.
3. Use the backdoor authentication bypass to access the management application as an administrator.
4. Review or export device configuration, users, extensions, SIP trunks, call routing, and call logs.
5. Create persistence by adding or modifying administrative users or remote-access settings.
6. Modify telephony settings such as call forwarding, dial plans, trunks, or extensions to enable fraud, interception, or disruption.
7. Optionally cover tracks by deleting logs or reverting visible configuration changes.

How to detect it

Investigate prior exploitation by collecting PBX management logs, web access logs if available, authentication logs, configuration-change history, call detail records, SIP trunk logs, firewall logs, VPN logs, and network flow data for the management interface. Look for administrative access from unfamiliar IP addresses, successful management sessions without a corresponding authorized change ticket, configuration exports, new or modified admin users, changes to call forwarding or dial plans, new SIP trunks, altered extension settings, unusual firmware or reboot events, and log-clearing activity. Review call records for spikes in outbound calls, after-hours calling, calls to unusual countries, premium-rate destinations, or repeated short-duration calls. If external exposure existed, correlate inbound HTTP/HTTPS connections to the PBX with subsequent configuration or call-routing changes. Because the public description does not provide a unique exploit payload or credential string, detection should focus on management access patterns and unauthorized PBX configuration or calling behavior rather than a single signature.

• Auerswald COMpact 5500R
• COMpact 5500R
• firmware 7.8A
• firmware 8.0B
• 7.8A
• 8.0B
• configuration export
• configuration changed
• administrator added
• admin user added
• call forwarding
• SIP trunk
• dial plan
• international call
• premium-rate

What your security team should do

• Immediately inventory Auerswald COMpact 5500R devices and identify firmware versions 7.8A and 8.0B.
• Prioritize remediation for any device with management access exposed to the Internet or broad internal networks.
• Upgrade to a vendor-supported fixed firmware release from Auerswald; if no safe upgrade is immediately available, isolate the management interface behind VPN and firewall allowlists.
• Rotate PBX administrator credentials after remediation and remove any unknown or unnecessary administrative accounts.
• Review SIP trunks, call forwarding, international dialing, premium-rate dialing, dial plans, and extensions for unauthorized changes.
• Check billing records and call detail records for unusual outbound calling, especially international, premium-rate, after-hours, or high-volume calls.
• Preserve and review management, authentication, configuration-change, and telephony logs for signs of prior exploitation.
• Monitor for renewed scanning or login attempts against the PBX web interface and alert on configuration changes outside approved maintenance windows.