Sangoma

Records98All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical21CVSS 9.0–10.0

CVSS high41CVSS 7.0–8.9

Exploited now

Sangoma records in CISA KEV

TI-2026-08422 Sangoma Switchvox SQL Injection Vulnerability CRITICAL 99KEV 2026-09-02 TI-2019-13698 Sangoma FreePBX Improper Authentication Vulnerability CRITICAL 100KEV 2026-02-03 TI-2025-39763 Sangoma FreePBX OS Command Injection Vulnerability CRITICAL 96KEV 2026-02-03 TI-2025-35702 Sangoma FreePBX Authentication Bypass Vulnerability CRITICAL 100KEV 2025-08-29

Components

Products in the NVD configurations · select one to filter the records

Freepbx 50 records CRITICAL Asterisk 28 records HIGH Certified Asterisk 15 records HIGH Restapps 2 records MEDIUM Session Border Controller Firmware 2 records MEDIUM Switchvox 2 records CRITICAL Voicemail 2 records LOW Filestore 1 record CRITICAL

Records

15 records in Certified Asterisk · all components

TI-2025-30244 CVE-2025-47779

Using malformed From header can forge identity with ";" or NULL in name portion

HIGH 73

Asterisk is an open-source private branch exchange (PBX).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00532 Published 2025-05-22 Fixed in 18.9-cert14, 18.26.2 +4 CWE-140

TI-2023-27195 CVE-2023-49786

Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation

HIGH 72

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05295 Published 2023-12-14 Fixed in 18.20.1, 20.5.1 +1 CWE-703

TI-2025-00959 CVE-2025-1131

Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation

HIGH 66

A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package.

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00218 Published 2025-09-23 No fix listed CWE-427

TI-2025-34699 CVE-2025-54995

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

MEDIUM 62

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00509 Published 2025-08-28 Fixed in 18.26.4, 18.9-cert17 CWE-1286

TI-2025-31747 CVE-2025-49832

Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation

MEDIUM 62

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0053 Published 2025-08-01 Fixed in 18.26.3, 20.15.1 +3 CWE-476

TI-2023-26930 CVE-2023-49294

Asterisk Path Traversal vulnerability

MEDIUM 62

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.45293 Published 2023-12-14 Fixed in 18.20.1, 20.5.1 +1 CWE-22

TI-2025-30245 CVE-2025-47780

cli_permissions.conf: deny option does not work for disallowing shell commands

MEDIUM 55

Asterisk is an open-source private branch exchange (PBX).

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00276 Published 2025-05-22 Fixed in 18.9-cert14, 18.26.2 +4 CWE-78

TI-2023-19067 CVE-2023-37457

Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'

LOW 38

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01116 Published 2023-12-14 No fix listed CWE-120

TI-2026-19114 CVE-2026-23741

Uncontrolled search path in asterisk

LOW 37

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00211 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-427

TI-2026-19113 CVE-2026-23740

Asterisk vulnerable to potential privilege escalation

LOW 35

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00136 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-427

TI-2022-20741 CVE-2022-42705 · GHSA-89gw-96wv-f4r4

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and…

LOW 32

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscrip…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01318 Published 2022-12-05 No fix listed CWE-416

TI-2026-19112 CVE-2026-23739

Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection

LOW 28

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00215 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-611

TI-2026-19111 CVE-2026-23738

Cross-site scripting in asterisk

LOW 27

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00192 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-79

TI-2024-28459 CVE-2024-42491

NULL pointer dereference in asterisk

LOW 26

Asterisk is an open-source private branch exchange (PBX).

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00581 Published 2024-09-05 Fixed in 18.24.3, 20.9.3 +3 CWE-252

TI-2022-20742 CVE-2022-42706 · GHSA-phq9-6f4r-97wc

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19…

LOW 25

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01176 Published 2022-12-05 No fix listed CWE-22

Open these records in search →