Sangoma

An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00291 Published 2024-12-02 No fix listed CWE-22

TI-2025-30245 CVE-2025-47780

cli_permissions.conf: deny option does not work for disallowing shell commands

MEDIUM 55

Asterisk is an open-source private branch exchange (PBX).

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00276 Published 2025-05-22 Fixed in 18.9-cert14, 18.26.2 +4 CWE-78

TI-2022-06096 CVE-2022-21723

Out-of-bounds read in multipart parsing in PJSIP

MEDIUM 52

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04357 Published 2022-01-27 No fix listed CWE-125

TI-2024-37922 CVE-2024-57520 · GHSA-4m27-833c-75q4

Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute…

MEDIUM 51

Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01044 Published 2025-02-05 No fix listed CWE-732

TI-2022-07661 CVE-2022-23608

Use after free in PJSIP

MEDIUM 50

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04022 Published 2022-02-22 No fix listed CWE-416

TI-2021-15581 CVE-2021-37706

Potential integer underflow upon receiving STUN message in PJSIP

MEDIUM 50

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04924 Published 2021-12-22 No fix listed CWE-191

TI-2012-01955 CVE-2012-2186 · GHSA-27ch-ccxg-45pf

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before…

MEDIUM 45

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 1…

CVSS 2.0HIGH 9.0 Network Low privileges Interaction — EPSS 0.03558 Published 2012-08-31 No fix listed

TI-2022-17399 CVE-2022-37325 · GHSA-m52q-h2w3-62w3

In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through…

MEDIUM 41

In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01237 Published 2022-12-05 No fix listed CWE-787

TI-2025-35652 CVE-2025-57767

Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request

LOW 39

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00425 Published 2025-08-28 Fixed in 22.5.2, 21.10.2 +1 CWE-253

TI-2009-02237 CVE-2009-2346 · GHSA-qm3m-5rgr-2hq8

The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x…

LOW 39

The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.02581 Published 2009-09-08 No fix listed CWE-119

TI-2018-08770 CVE-2018-12228 · GHSA-wcxf-gxv3-7xch

An issue was discovered in Asterisk Open Source 15.x before 15.4.1.

LOW 38

An issue was discovered in Asterisk Open Source 15.x before 15.4.1.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06462 Published 2018-06-12 No fix listed CWE-835

TI-2017-06782 CVE-2017-9358 · GHSA-7x8q-x29w-wpg4

A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and…

LOW 38

A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packet…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02743 Published 2017-06-02 No fix listed CWE-835

TI-2026-19114 CVE-2026-23741

Uncontrolled search path in asterisk

LOW 37

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00211 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-427

TI-2026-19113 CVE-2026-23740

Asterisk vulnerable to potential privilege escalation

LOW 35

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00136 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-427

TI-2009-03547 CVE-2009-3723 · GHSA-g343-h29p-q8m3

asterisk allows calls on prohibited networks

LOW 35

asterisk allows calls on prohibited networks

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01226 Published 2019-10-29 No fix listed CWE-863

TI-2024-23263 CVE-2024-35190

Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests

LOW 33

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00564 Published 2024-05-17 No fix listed CWE-303

TI-2022-20741 CVE-2022-42705 · GHSA-89gw-96wv-f4r4

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and…

LOW 32

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscrip…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01318 Published 2022-12-05 No fix listed CWE-416

TI-2020-17153 CVE-2020-28242 · GHSA-q5gr-h5mj-hp63

An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1…

LOW 32

An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01516 Published 2020-11-06 No fix listed CWE-674

TI-2026-19112 CVE-2026-23739

Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection

LOW 28

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00215 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-611

TI-2020-17177 CVE-2020-28327 · GHSA-ggx6-v629-c48v

A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1…

LOW 28

A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01939 Published 2020-11-06 No fix listed CWE-404

TI-2026-19111 CVE-2026-23738

Cross-site scripting in asterisk

LOW 27

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00192 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-79

Open these records in search →