CVE-2014-4046
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6...
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
Exploit likelihood
What each source reports
NVD Score used
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
- Record
CVE-2014-4046- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
- Record
CVE-2014-4046- Updated
- 2026-11-02
EUVDEUVD-2014-3977 No score
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
- Record
EUVD-2014-3977- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w674-3mq5-fw7c No score
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6...
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
- Record
GHSA-w674-3mq5-fw7c- Updated
- 2026-11-02
OSV No score
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
- Record
CVE-2014-4046- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-4046 No score
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
- Record
DEBIAN-CVE-2014-4046- Updated
- 2026-11-02
OSVMGASA-2014-0300 No score
Updated asterisk packages fix security vulnerabilities
Updated asterisk packages fix security vulnerabilities:
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action (CVE-2014-4046).
Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections (CVE-2014-4047).
- Record
MGASA-2014-0300- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:11.10.2~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:11.10.2~dfsg-1 |
asteriskDebian:7 From an advisory covering 6 CVEs |
before 1:1.8.13.1~dfsg1-3+deb7u4, plus listed versions 1:1.8.13.1~dfsg-31:1.8.13.1~dfsg-3+deb7u11:1.8.13.1~dfsg-3+deb7u21:1.8.13.1~dfsg1-3+deb7u3 |
1:1.8.13.1~dfsg1-3+deb7u4 |
asteriskMageia:3 From an advisory covering 2 CVEs |
before 11.11.0-1.mga3 | 11.11.0-1.mga3 |
asteriskMageia:4 From an advisory covering 2 CVEs |
before 11.11.0-1.mga4 | 11.11.0-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-4046 is a medium vulnerability (CVSS 6.5) in Digium Asterisk, published June 17, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.68%, the 93rd percentile. Fixed in asterisk 1:11.10.2~dfsg-1.
References
securityfocus.com/archive/1/532419/100/0/threaded
packetstormsecurity.com/files/127088/Asterisk-Project-Security-Advisory-AST-2014-006.html
downloads.asterisk.org/pub/security/AST-2014-006.html
nvd.nist.gov/vuln/detail/CVE-2014-4046
github.com/advisories/GHSA-w674-3mq5-fw7c
security-tracker.debian.org/tracker/CVE-2014-4046
Left out here: 126 versions. The JSON record has them.