Vulnerabilities

TI-2026-19114 CVE-2026-23741

Uncontrolled search path in asterisk

LOW 37

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00211 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-427

TI-2026-19113 CVE-2026-23740

Asterisk vulnerable to potential privilege escalation

LOW 35

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00136 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-427

TI-2026-19112 CVE-2026-23739

Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection

LOW 28

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00215 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-611

TI-2026-19111 CVE-2026-23738

Cross-site scripting in asterisk

LOW 27

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00192 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-79

TI-2025-00959 CVE-2025-1131

Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation

HIGH 66

A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package.

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00218 Published 2025-09-23 No fix listed CWE-427

TI-2025-35652 CVE-2025-57767

Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request

LOW 39

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00425 Published 2025-08-28 Fixed in 22.5.2, 21.10.2 +1 CWE-253

TI-2025-34699 CVE-2025-54995

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

MEDIUM 62

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00509 Published 2025-08-28 Fixed in 18.26.4, 18.9-cert17 CWE-1286

TI-2025-31747 CVE-2025-49832

Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation

MEDIUM 62

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0053 Published 2025-08-01 Fixed in 18.26.3, 20.15.1 +3 CWE-476

TI-2025-30245 CVE-2025-47780

cli_permissions.conf: deny option does not work for disallowing shell commands

MEDIUM 55

Asterisk is an open-source private branch exchange (PBX).

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00276 Published 2025-05-22 Fixed in 18.9-cert14, 18.26.2 +4 CWE-78

TI-2025-30244 CVE-2025-47779

Using malformed From header can forge identity with ";" or NULL in name portion

HIGH 73

Asterisk is an open-source private branch exchange (PBX).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00532 Published 2025-05-22 Fixed in 18.9-cert14, 18.26.2 +4 CWE-140

TI-2024-37922 CVE-2024-57520 · GHSA-4m27-833c-75q4

Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute…

MEDIUM 51

Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01044 Published 2025-02-05 No fix listed CWE-732

TI-2024-35843 CVE-2024-53566 · GHSA-2fr9-xph3-mm3j

An issue in the action_listcategories() function of Sangoma Asterisk…

MEDIUM 58

An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00291 Published 2024-12-02 No fix listed CWE-22

TI-2024-28459 CVE-2024-42491

NULL pointer dereference in asterisk

LOW 26

Asterisk is an open-source private branch exchange (PBX).

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00581 Published 2024-09-05 Fixed in 18.24.3, 20.9.3 +3 CWE-252

TI-2024-23263 CVE-2024-35190

Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests

LOW 33

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00564 Published 2024-05-17 No fix listed CWE-303

TI-2022-20742 CVE-2022-42706 · GHSA-phq9-6f4r-97wc

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19…

LOW 25

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01176 Published 2022-12-05 No fix listed CWE-22

TI-2022-20741 CVE-2022-42705 · GHSA-89gw-96wv-f4r4

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and…

LOW 32

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscrip…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01318 Published 2022-12-05 No fix listed CWE-416

TI-2022-17399 CVE-2022-37325 · GHSA-m52q-h2w3-62w3

In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through…

MEDIUM 41

In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01237 Published 2022-12-05 No fix listed CWE-787

TI-2022-07661 CVE-2022-23608

Use after free in PJSIP

MEDIUM 50

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04022 Published 2022-02-22 No fix listed CWE-416

TI-2022-06096 CVE-2022-21723

Out-of-bounds read in multipart parsing in PJSIP

MEDIUM 52

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04357 Published 2022-01-27 No fix listed CWE-125

TI-2021-15581 CVE-2021-37706

Potential integer underflow upon receiving STUN message in PJSIP

MEDIUM 50

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04924 Published 2021-12-22 No fix listed CWE-191

TI-2020-17177 CVE-2020-28327 · GHSA-ggx6-v629-c48v

A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1…

LOW 28

A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01939 Published 2020-11-06 No fix listed CWE-404

TI-2020-17153 CVE-2020-28242 · GHSA-q5gr-h5mj-hp63

An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1…

LOW 32

An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01516 Published 2020-11-06 No fix listed CWE-674

TI-2009-03547 CVE-2009-3723 · GHSA-g343-h29p-q8m3

asterisk allows calls on prohibited networks

LOW 35

asterisk allows calls on prohibited networks

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01226 Published 2019-10-29 No fix listed CWE-863

TI-2018-08770 CVE-2018-12228 · GHSA-wcxf-gxv3-7xch

An issue was discovered in Asterisk Open Source 15.x before 15.4.1.

LOW 38

An issue was discovered in Asterisk Open Source 15.x before 15.4.1.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06462 Published 2018-06-12 No fix listed CWE-835

TI-2017-06782 CVE-2017-9358 · GHSA-7x8q-x29w-wpg4

A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and…

LOW 38

A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packet…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02743 Published 2017-06-02 No fix listed CWE-835

Vulnerabilities

Filters