Read the docs
TI-2026-19113 Aliases CVE-2026-23740

Asterisk vulnerable to potential privilege escalation

Priority LOW 35CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-427.

Summary

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix Fixed asterisk (asterisk): 23.2.2, 22.8.2, 21.12.1 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 23.2.2; before 22.8.2; before 21.12.1; before 20.18.2; before 20.7-cert923.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9Patch availableCNA
  • asterisk Vendorasterisk Affected before 23.2.2; before 22.8.2; before 21.12.1; before 20.18.2; before 20.7-cert9 Fixed in 23.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9 Patch available CNA

CPE configurations NVD · 67

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:-:*:*:*:*:*:*13.13.0VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1:*:*:*:*:*:*13.13.0 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc1:*:*:*:*:*:*13.13.0 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc2:*:*:*:*:*:*13.13.0 cert1-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc3:*:*:*:*:*:*13.13.0 cert1-rc3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc4:*:*:*:*:*:*13.13.0 cert1-rc4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert2:*:*:*:*:*:*13.13.0 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert3:*:*:*:*:*:*13.13.0 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc1:*:*:*:*:*:*13.13.0 rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc2:*:*:*:*:*:*13.13.0 rc2VulnerableSangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:-:*:*:*:*:*:* Versions 13.13.0 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1:*:*:*:*:*:* Versions 13.13.0 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc1:*:*:*:*:*:* Versions 13.13.0 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc2:*:*:*:*:*:* Versions 13.13.0 cert1-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc3:*:*:*:*:*:* Versions 13.13.0 cert1-rc3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc4:*:*:*:*:*:* Versions 13.13.0 cert1-rc4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert2:*:*:*:*:*:* Versions 13.13.0 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert3:*:*:*:*:*:* Versions 13.13.0 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc1:*:*:*:*:*:* Versions 13.13.0 rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc2:*:*:*:*:*:* Versions 13.13.0 rc2 Vulnerable ·Sangoma
Show 57 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*16.8 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*16.8 cert1-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*16.8 cert1-rc3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*16.8 cert1-rc4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc5:*:*:*:*:*:*16.8 cert1-rc5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert10:*:*:*:*:*:*16.8 cert10VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert11:*:*:*:*:*:*16.8 cert11VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert12:*:*:*:*:*:*16.8 cert12VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert13:*:*:*:*:*:*16.8 cert13VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert14:*:*:*:*:*:*16.8 cert14VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*16.8 cert4-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*16.8 cert4-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*16.8 cert4-rc3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*16.8 cert4-rc4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:-:*:*:*:*:*:*16.8.0VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert1:*:*:*:*:*:*16.8.0 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert10:*:*:*:*:*:*16.8.0 cert10VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert11:*:*:*:*:*:*16.8.0 cert11VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert12:*:*:*:*:*:*16.8.0 cert12VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert2:*:*:*:*:*:*16.8.0 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert3:*:*:*:*:*:*16.8.0 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert4:*:*:*:*:*:*16.8.0 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert5:*:*:*:*:*:*16.8.0 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert6:*:*:*:*:*:*16.8.0 cert6VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert7:*:*:*:*:*:*16.8.0 cert7VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert8:*:*:*:*:*:*16.8.0 cert8VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert9:*:*:*:*:*:*16.8.0 cert9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:*18.9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*18.9 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*18.9 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*18.9 cert10VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*18.9 cert11VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:*18.9 cert12VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:*18.9 cert13VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert14:*:*:*:*:*:*18.9 cert14VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert15:*:*:*:*:*:*18.9 cert15VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert16:*:*:*:*:*:*18.9 cert16VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*18.9 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*18.9 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*18.9 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*18.9 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*18.9 cert6VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*18.9 cert7VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*18.9 cert8VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*18.9 cert8-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*18.9 cert8-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*18.9 cert9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*20.7 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*20.7 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*20.7 cert1-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*20.7 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*20.7 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*20.7 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*20.7 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*20.7 cert6VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:*20.7 cert7VulnerableSangoma
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*before 20.18.2; 21.0.0 to before 21.12.1; 22.0.0 to before 22.8.2; 23.0.0 to before 23.2.2VulnerableSangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:* Versions 16.8 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:* Versions 16.8 cert1-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:* Versions 16.8 cert1-rc3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:* Versions 16.8 cert1-rc4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc5:*:*:*:*:*:* Versions 16.8 cert1-rc5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert10:*:*:*:*:*:* Versions 16.8 cert10 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert11:*:*:*:*:*:* Versions 16.8 cert11 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert12:*:*:*:*:*:* Versions 16.8 cert12 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert13:*:*:*:*:*:* Versions 16.8 cert13 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert14:*:*:*:*:*:* Versions 16.8 cert14 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:* Versions 16.8 cert4-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:* Versions 16.8 cert4-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:* Versions 16.8 cert4-rc3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:* Versions 16.8 cert4-rc4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:-:*:*:*:*:*:* Versions 16.8.0 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert1:*:*:*:*:*:* Versions 16.8.0 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert10:*:*:*:*:*:* Versions 16.8.0 cert10 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert11:*:*:*:*:*:* Versions 16.8.0 cert11 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert12:*:*:*:*:*:* Versions 16.8.0 cert12 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert2:*:*:*:*:*:* Versions 16.8.0 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert3:*:*:*:*:*:* Versions 16.8.0 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert4:*:*:*:*:*:* Versions 16.8.0 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert5:*:*:*:*:*:* Versions 16.8.0 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert6:*:*:*:*:*:* Versions 16.8.0 cert6 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert7:*:*:*:*:*:* Versions 16.8.0 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert8:*:*:*:*:*:* Versions 16.8.0 cert8 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert9:*:*:*:*:*:* Versions 16.8.0 cert9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:* Versions 18.9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:* Versions 18.9 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:* Versions 18.9 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:* Versions 18.9 cert10 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:* Versions 18.9 cert11 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:* Versions 18.9 cert12 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:* Versions 18.9 cert13 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert14:*:*:*:*:*:* Versions 18.9 cert14 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert15:*:*:*:*:*:* Versions 18.9 cert15 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert16:*:*:*:*:*:* Versions 18.9 cert16 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:* Versions 18.9 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:* Versions 18.9 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:* Versions 18.9 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:* Versions 18.9 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:* Versions 18.9 cert6 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:* Versions 18.9 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:* Versions 18.9 cert8 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:* Versions 18.9 cert8-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:* Versions 18.9 cert8-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:* Versions 18.9 cert9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:* Versions 20.7 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:* Versions 20.7 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:* Versions 20.7 cert1-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:* Versions 20.7 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:* Versions 20.7 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:* Versions 20.7 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:* Versions 20.7 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:* Versions 20.7 cert6 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:* Versions 20.7 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions before 20.18.2; 21.0.0 to before 21.12.1; 22.0.0 to before 22.8.2; 23.0.0 to before 23.2.2 Vulnerable ·Sangoma

Remediation

  • Fix · CNA asterisk (asterisk) Fixed in 23.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23740

References

Advisory 1

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences