asterisk

Records88All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high37CVSS 7.0–8.9

Exploited now

asterisk records in CISA KEV

No asterisk vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Open Source 22 records MEDIUM Asterisk 20 records HIGH Asterisk Appliance Developer Kit 13 records MEDIUM Asterisknow 13 records MEDIUM Asterisk Business Edition 11 records MEDIUM Certified Asterisk 11 records HIGH S800i 7 records MEDIUM S800i Appliance 5 records MEDIUM

Records

20 records in Asterisk · all components

TI-2024-28351 CVE-2024-42365

Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

HIGH 71

Asterisk is an open source private branch exchange (PBX) and telephony toolkit.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04703 Published 2024-08-08 Fixed in 18.24.2, 20.9.2 +3 CWE-1220

TI-2008-03125 CVE-2008-3263 · GHSA-w3xv-vhr5-qfqw

The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and…

MEDIUM 57

The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Ki…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.28 Published 2008-07-22 No fix listed CWE-399

TI-2007-02211 CVE-2007-2293 · GHSA-hrm2-xm5m-6mfh

Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the…

MEDIUM 54

Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManage…

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.23878 Published 2007-04-26 No fix listed

TI-2007-02404 CVE-2007-2488 · GHSA-w22m-8gr9-p75j

The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null…

MEDIUM 50

The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null terminate data, which allows remote attackers to trigger loss of transmitted data, and possibly obtain sensitive information (memory…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04323 Published 2007-05-07 No fix listed

TI-2007-01503 CVE-2007-1561 · GHSA-jwxq-x6h2-p3qv

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote…

MEDIUM 50

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.14928 Published 2007-03-21 No fix listed

TI-2007-03651 CVE-2007-3762 · GHSA-cwmp-cc64-x5pj

Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before…

MEDIUM 48

Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s8…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05506 Published 2007-07-18 No fix listed

TI-2008-01337 CVE-2008-1390 · GHSA-4h7j-rpcg-6w8h

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x…

MEDIUM 47

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03837 Published 2008-03-24 No fix listed CWE-255

TI-2007-03653 CVE-2007-3764 · GHSA-c8c6-m3x8-7cq5

The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8…

MEDIUM 47

The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows rem…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.3152 Published 2007-07-18 No fix listed

TI-2007-03652 CVE-2007-3763 · GHSA-822c-3x4j-h56q

The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8…

MEDIUM 45

The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.2656 Published 2007-07-18 No fix listed

TI-2008-01282 CVE-2008-1332 · GHSA-p49c-76rr-74ww

Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before…

MEDIUM 43

Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Applian…

CVSS 2.0HIGH 8.8 Network No auth Interaction — EPSS 0.02327 Published 2008-03-20 No fix listed CWE-264

TI-2007-02212 CVE-2007-2294 · GHSA-769c-mjpc-3rqq

The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote…

MEDIUM 41

The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (crash) by using MD5 authentication to authenticate a user that does not have a password defined…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.03863 Published 2007-04-26 No fix listed

TI-2009-02237 CVE-2009-2346 · GHSA-qm3m-5rgr-2hq8

The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x…

LOW 39

The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.02581 Published 2009-09-08 No fix listed CWE-119

TI-2007-02215 CVE-2007-2297 · GHSA-w3jr-jp8f-r2vr

The SIP channel driver (chan_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does…

LOW 39

The SIP channel driver (chan_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not contain a valid response code, which allows remote attackers to cause a denial of ser…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.02392 Published 2007-04-26 No fix listed

TI-2007-01535 CVE-2007-1594 · GHSA-vf6r-f898-98gf

The handle_response function in chan_sip.c in Asterisk before 1.2.17 and 1.4.x before…

LOW 39

The handle_response function in chan_sip.c in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP Response code 0 in a SIP packet.

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.02701 Published 2007-03-22 No fix listed

TI-2007-01536 CVE-2007-1595 · GHSA-2h5w-3h6g-pgqq

The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly…

LOW 38

The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02685 Published 2007-03-22 No fix listed

TI-2010-00419 CVE-2010-0441 · GHSA-q2qq-4jfp-7w3h

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before…

LOW 29

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service (daemon crash) via an SIP T…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03377 Published 2010-02-04 No fix listed CWE-20

TI-2007-04376 CVE-2007-4521 · GHSA-58rf-9xjg-2wv7

Asterisk Open Source 1.4.5 through 1.4.11, when configured to use an IMAP voicemail…

LOW 28

Asterisk Open Source 1.4.5 through 1.4.11, when configured to use an IMAP voicemail storage backend, allows remote attackers to cause a denial of service via an e-mail with an "invalid/corrupted" MIME body, which trigger…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02998 Published 2007-08-28 No fix listed

TI-2007-04315 CVE-2007-4455 · GHSA-c3jc-cr5w-8999

The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11…

LOW 26

The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11, AsteriskNOW before beta7, Asterisk Appliance Developer Kit 0.x before 0.8.0, and s800i (Asterisk Appliance) 1.x before 1.0.3 allows remote at…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01775 Published 2007-08-22 No fix listed

TI-2007-03654 CVE-2007-3765 · GHSA-f9w4-q8jc-qc4v

The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7…

LOW 26

The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted ST…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0169 Published 2007-07-18 No fix listed

TI-2007-04143 CVE-2007-4280 · GHSA-3p5p-863p-q64f

The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10…

LOW 19

The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01149 Published 2007-08-09 No fix listed

Open these records in search →

Critical	7
High	37
Medium	38
Low	6
No CVSS	0