--- title: Analysis of CVE-2021-44228 log4 Vulnerability for ECG Software - ECG description: "Background In reference to CVE-2021-44228, the Log4j Remote Code Execution (RCE) 0-day vulnerability and exploit: Based on our understanding, in logging so" --- [![ECG](https://www.ecg.co/hubfs/lp/cloud-migration/logo-vector.svg)](https://www.ecg.co) - Who We Are Company [**About ECG** Learn about the team behind the networks and services that solve real problems.](https://www.ecg.co/about) [**Careers** Join a fun, collaborative, engineer-owned company.](https://www.ecg.co/careers) Industries We Serve [**Enterprises** Optimize multi-site voice networks while meeting compliance requirements.](https://www.ecg.co/sectors/enterprise) [**Universities** Professional services designed for the unique needs of campus networks.](https://www.ecg.co/sectors/universities) [**Government** Engineering services built for government agency voice challenges.](https://www.ecg.co/sectors/government) [**Service Providers** Deep voice expertise to maintain compliance and keep customers connected.](https://www.ecg.co/sectors/service-providers) - Technologies **Carrier & Trunking Services** SIP trunking, resilience & carrier interconnect **Compliance & Call Authentication** STIR/SHAKEN, 603+ & secure signaling **Unified Communications & Collaboration** UC capabilities & platform expertise **Platform Reliability & Security** Infrastructure, capture & network fundamentals ### Carrier & Trunking Services Design, harden, and secure the carrier side of your voice network — from SIP trunking to encrypted media and compliant recording. [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) ### Compliance & Call Authentication Meet regulatory requirements end-to-end — call authentication, robocall mitigation, lawful capture, and encrypted signaling. [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) ### Unified Communications & Collaboration Modern UC capabilities backed by deep, hands-on expertise across every major voice platform. [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) ### Platform Reliability & Security The infrastructure layer underneath your voice services — engineered, monitored, and secured by people who run it every day. [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) - How We Do It Services [**Services Overview** Our experience and expertise in voice and data engineering.](https://www.ecg.co/services) [**Network Operations** Keep your voice network running with outsourced network operations.](https://www.ecg.co/services/network-operations) [**Staff Augmentation** Expert engineering support to meet deadlines and fill knowledge gaps.](https://www.ecg.co/services/staff-augmentation) [**IT Consulting & Engineering** Complete short-term projects faster with a dedicated project manager.](https://www.ecg.co/services/it-consulting-and-engineering) - Resources #### [Utilities Launch Delay Calculator Estimate what a potential product launch delay would cost your business. Try the calculator](https://www.ecg.co/cost-delay-calculator) #### [Resource Library Guides, White Papers & Tools In-depth resources on voice engineering, compliance, and AI — built from real client work. Explore resources](https://www.ecg.co/resource-library) #### [Blog Latest from the ECG Team Practical articles on SIP, UC platforms, network operations, and voice AI. Read the blog](https://www.ecg.co/blog) - [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) Who We Are [About ECG](https://www.ecg.co/about) [Careers](https://www.ecg.co/careers) Industries We Serve [Enterprises](https://www.ecg.co/sectors/enterprise) [Universities](https://www.ecg.co/sectors/universities) [Government](https://www.ecg.co/sectors/government) [Service Providers](https://www.ecg.co/sectors/service-providers) Technologies Carrier & Trunking Services [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) Compliance & Call Authentication [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) Unified Communications & Collaboration [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) Platform Reliability & Security [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) How We Do It Services [Services Overview](https://www.ecg.co/services) [Network Operations](https://www.ecg.co/services/network-operations) [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) Resources [Launch Delay Calculator](https://www.ecg.co/cost-delay-calculator) [Guides, White Papers & Tools](https://www.ecg.co/resource-library) [Latest from the ECG Team](https://www.ecg.co/blog) [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) # Analysis of CVE-2021-44228 log4 Vulnerability for ECG Software By: ECG Team 1 min read Dec 14, 2021 ## Background In reference to CVE-2021-44228, the Log4j Remote Code Execution (RCE) 0-day vulnerability and exploit: Based on our understanding, in logging software component "log4j" releases prior to 2.14.1 have a vulnerability so that an attacker who can do the following would be able to run software (execute code) on the system running log4j: - **Generate log message content** - **Setup an LDAP server reachable from the system running log4j**   ## **Impact on ECG Software** **log4j was included in Alpaca until release 8.0 released January 18, 2021. As of that release, only the naming (interface API) is included in Alpaca. Thus the vulnerabilities in CVE-2021-44228 are not present in Alpaca versions 8.0 and later.** **log4j was included in CallReporter until release 3.4 released September 24, 2021. As of that release, only the naming (interface API) is included in CallReporter. Thus the vulnerabilities in CVE-2021-44228 are not present in CallReporter versions 3.4 and later.** **Older versions of Alpaca and CallReporter should be upgraded to remove log4j. Users can mitigate vulnerability of running older releases by filtering outbound access using firewalls to prevent any attempts to connect outbound from the system where Alpaca or CallReporter are operating.** ## Vulnerability Testing **ECG has performed penetration testing on the log4j naming (interface API) included in Alpaca 8.0 and CallReporter 3.4, and confirmed that the vulnerability does not exist. The vulnerable log4j will perform lookups against remote databases (JNDI substitution), while the Alpaca logging capability performs no such remote connections.** **CVE-2021-44228 vulnerability requires an attacker to be able to generate arbitrary log messages. We believe this was never the case in ECG products.**     ## Similar posts [![SIP Registration with Authentication - Excerpt from ECGT2010 Training](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/146-sip-registration-with-authentication-excerpt-from-ecgt2010-training) ### [SIP Registration with Authentication - Excerpt from ECGT2010 Training](https://www.ecg.co/blog/146-sip-registration-with-authentication-excerpt-from-ecgt2010-training) [![ECG: Engineering BroadWorks at US Department of Justice](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/132-ecg-engineering-broadworks-at-us-department-of-justice) ### [ECG: Engineering BroadWorks at US Department of Justice](https://www.ecg.co/blog/132-ecg-engineering-broadworks-at-us-department-of-justice) [![Cisco-BroadSoft Pushes BroadWorks Operators Toward Better Patching](https://www.ecg.co/hubfs/Imported_Blog_Media/regular_0013AD1A-740F-429F-98B9-0897073DCBF1-1.png)](https://www.ecg.co/blog/136-cisco-broadsoft-pushes-broadworks-operators-toward-better-patching) ### [Cisco-BroadSoft Pushes BroadWorks Operators Toward Better Patching](https://www.ecg.co/blog/136-cisco-broadsoft-pushes-broadworks-operators-toward-better-patching) ## Need Help With Your Network or AI Project? Get expert advice from engineers who've solved complex problems for carriers, enterprises, and government agencies. [Let's Talk](https://www.ecg.co/contact) [![ecg-logo-white](https://www.ecg.co/hubfs/ecg-site/global/ecg-logo-white.svg "ecg-logo-white")](https://www.ecg.co/) 505 North Toombs St. Suite A Valdosta, Georgia 31601 USA #### Headquarters - 1.866.324.0700 US Toll-free - 1.229.244.2099 International - 1.229.244.2399 Fax - [info@e-c-group.com](mailto:info@e-c-group.com) #### Services - [Overview](https://www.ecg.co/services) - [Network Operations](https://www.ecg.co/services/network-operations) - [Custom AI Development](https://www.ecg.co/services/custom-ai-development) - [Outsourced NOC Support](https://www.ecg.co/services/outsourced-noc-support) - [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) - [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) #### Company - [About](https://www.ecg.co/about) - [Careers](https://www.ecg.co/careers) - [Blog](https://www.ecg.co/blog) - [Resources](https://www.ecg.co/resource-library) - [Events](https://www.ecg.co/events) © ECG, Inc. [Privacy Policy](https://9353907.hs-sites.com/privacy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "ECG Team", "url" : "https://www.ecg.co/blog/author/ecg-team" }, "dateModified" : "2025-03-31T09:04:23.456Z", "datePublished" : "2021-12-14T05:00:00.000Z", "headline" : "Analysis of CVE-2021-44228 log4 Vulnerability for ECG Software - ECG", "mainEntityOfPage" : { "@id" : "https://www.ecg.co/blog/162-analysis-of-cve-2021-44228-log4-vulnerability-for-ecg-software", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.ecg.co/hubfs/ECG_hexagons_and_url_borderless.jpeg" }, "name" : "ECG, Inc" } } ```