asterisk

Records88All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high37CVSS 7.0–8.9

Exploited now

asterisk records in CISA KEV

No asterisk vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Open Source 22 records MEDIUM Asterisk 20 records HIGH Asterisk Appliance Developer Kit 13 records MEDIUM Asterisknow 13 records MEDIUM Asterisk Business Edition 11 records MEDIUM Certified Asterisk 11 records HIGH S800i 7 records MEDIUM S800i Appliance 5 records MEDIUM

Records

88 records

TI-2025-30244 CVE-2025-47779

Using malformed From header can forge identity with ";" or NULL in name portion

HIGH 73

Asterisk is an open-source private branch exchange (PBX).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00532 Published 2025-05-22 Fixed in 18.9-cert14, 18.26.2 +4 CWE-140

TI-2023-27195 CVE-2023-49786

Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation

HIGH 72

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05295 Published 2023-12-14 Fixed in 18.20.1, 20.5.1 +1 CWE-703

TI-2024-28351 CVE-2024-42365

Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

HIGH 71

Asterisk is an open source private branch exchange (PBX) and telephony toolkit.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04703 Published 2024-08-08 Fixed in 18.24.2, 20.9.2 +3 CWE-1220

TI-2025-00959 CVE-2025-1131

Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation

HIGH 66

A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package.

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00218 Published 2025-09-23 No fix listed CWE-427

TI-2025-34699 CVE-2025-54995

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

MEDIUM 62

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00509 Published 2025-08-28 Fixed in 18.26.4, 18.9-cert17 CWE-1286

TI-2025-31747 CVE-2025-49832

Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation

MEDIUM 62

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0053 Published 2025-08-01 Fixed in 18.26.3, 20.15.1 +3 CWE-476

TI-2023-26930 CVE-2023-49294

Asterisk Path Traversal vulnerability

MEDIUM 62

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.45293 Published 2023-12-14 Fixed in 18.20.1, 20.5.1 +1 CWE-22

TI-2008-03125 CVE-2008-3263 · GHSA-w3xv-vhr5-qfqw

The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and…

MEDIUM 57

The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Ki…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.28 Published 2008-07-22 No fix listed CWE-399

TI-2025-30245 CVE-2025-47780

cli_permissions.conf: deny option does not work for disallowing shell commands

MEDIUM 55

Asterisk is an open-source private branch exchange (PBX).

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00276 Published 2025-05-22 Fixed in 18.9-cert14, 18.26.2 +4 CWE-78

TI-2007-02211 CVE-2007-2293 · GHSA-hrm2-xm5m-6mfh

Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the…

MEDIUM 54

Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManage…

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.23878 Published 2007-04-26 No fix listed

TI-2022-06096 CVE-2022-21723

Out-of-bounds read in multipart parsing in PJSIP

MEDIUM 52

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04357 Published 2022-01-27 No fix listed CWE-125

TI-2022-07661 CVE-2022-23608

Use after free in PJSIP

MEDIUM 50

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04022 Published 2022-02-22 No fix listed CWE-416

TI-2021-15581 CVE-2021-37706

Potential integer underflow upon receiving STUN message in PJSIP

MEDIUM 50

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04924 Published 2021-12-22 No fix listed CWE-191

TI-2007-02404 CVE-2007-2488 · GHSA-w22m-8gr9-p75j

The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null…

MEDIUM 50

The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null terminate data, which allows remote attackers to trigger loss of transmitted data, and possibly obtain sensitive information (memory…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04323 Published 2007-05-07 No fix listed

TI-2007-01503 CVE-2007-1561 · GHSA-jwxq-x6h2-p3qv

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote…

MEDIUM 50

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.14928 Published 2007-03-21 No fix listed

TI-2007-03651 CVE-2007-3762 · GHSA-cwmp-cc64-x5pj

Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before…

MEDIUM 48

Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s8…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05506 Published 2007-07-18 No fix listed

TI-2008-01337 CVE-2008-1390 · GHSA-4h7j-rpcg-6w8h

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x…

MEDIUM 47

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03837 Published 2008-03-24 No fix listed CWE-255

TI-2007-03653 CVE-2007-3764 · GHSA-c8c6-m3x8-7cq5

The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8…

MEDIUM 47

The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows rem…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.3152 Published 2007-07-18 No fix listed

TI-2008-01239 CVE-2008-1289 · GHSA-xjqv-ch5c-vc5h

Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3…

MEDIUM 46

Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.11523 Published 2008-03-24 No fix listed CWE-119

TI-2012-01955 CVE-2012-2186 · GHSA-27ch-ccxg-45pf

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before…

MEDIUM 45

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 1…

CVSS 2.0HIGH 9.0 Network Low privileges Interaction — EPSS 0.03558 Published 2012-08-31 No fix listed

TI-2007-03652 CVE-2007-3763 · GHSA-822c-3x4j-h56q

The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8…

MEDIUM 45

The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.2656 Published 2007-07-18 No fix listed

TI-2008-00085 CVE-2008-0095 · GHSA-hvrv-phcf-pfqg

The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition…

MEDIUM 44

The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x bef…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.25423 Published 2008-01-08 No fix listed CWE-399

TI-2008-01282 CVE-2008-1332 · GHSA-p49c-76rr-74ww

Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before…

MEDIUM 43

Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Applian…

CVSS 2.0HIGH 8.8 Network No auth Interaction — EPSS 0.02327 Published 2008-03-20 No fix listed CWE-264

TI-2026-81563 CVE-2026-57191

Stack buffer overflow in Asterisk MWI NOTIFY parsing

MEDIUM 42

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00592 Published 2026-10-27 Fixed in 20.20.1, 21.12.3 +4 CWE-120

TI-2007-02212 CVE-2007-2294 · GHSA-769c-mjpc-3rqq

The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote…

MEDIUM 41

The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (crash) by using MD5 authentication to authenticate a user that does not have a password defined…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.03863 Published 2007-04-26 No fix listed

Open these records in search →

Critical	7
High	37
Medium	38
Low	6
No CVSS	0