Sangoma Asterisk vulnerabilities

• asterisk, sangoma certified asterisk +1 more ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation CVE-2026-23741 Fix available 0.0 NoneFebruary 6, 2026
• asterisk, sangoma certified asterisk +1 more Asterisk vulnerable to potential privilege escalation CVE-2026-23740 Fix available 0.0 NoneFebruary 6, 2026
• asterisk, sangoma certified asterisk +1 more Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection CVE-2026-23739 Fix available 2.0 LowFebruary 6, 2026
• asterisk, sangoma certified asterisk +1 more The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization CVE-2026-23738 Fix available 3.5 LowFebruary 6, 2026
• asterisk, sangoma certified asterisk +1 more Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVE-2025-1131 Fix available 7.0 HighSeptember 23, 2025
• asterisk Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request CVE-2025-57767 Fix available 7.5 HighAugust 28, 2025
• asterisk, sangoma certified asterisk +1 more Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVE-2025-54995 Fix available 6.5 MediumAugust 28, 2025
• asterisk, sangoma certified asterisk +1 more Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVE-2025-49832 Fix available 6.5 MediumAugust 1, 2025
• asterisk, sangoma certified asterisk +1 more cli_permissions.conf: deny option does not work for disallowing shell commands CVE-2025-47780 Fix available 4.8 MediumMay 22, 2025
• asterisk, sangoma certified asterisk +1 more Using malformed From header can forge identity with ";" or NULL in name portion CVE-2025-47779 Fix available 7.7 HighMay 22, 2025
• sangoma asterisk Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary... CVE-2024-57520 Fix availableDisputed 9.8 CriticalFebruary 5, 2025
• sangoma asterisk, debian linux +1 more An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0... CVE-2024-53566 Fix available 5.5 MediumDecember 2, 2024
• asterisk, sangoma certified asterisk +1 more A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used CVE-2024-42491 Fix available 5.7 MediumSeptember 5, 2024
• asterisk Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests CVE-2024-35190 Fix available 5.8 MediumMay 17, 2024
• asterisk, sangoma certified asterisk +1 more Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVE-2023-49786 Fix available 7.5 HighDecember 14, 2023
• asterisk, sangoma certified asterisk +1 more Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update' CVE-2023-37457 Fix available 7.5 HighDecember 14, 2023
• asterisk, sangoma certified asterisk +1 more Asterisk Path Traversal vulnerability CVE-2023-49294 Fix available EPSS 45.3% 4.9 MediumDecember 14, 2023
• sangoma asterisk, certified asterisk +1 more An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19... CVE-2022-42706 Fix available 4.9 MediumDecember 5, 2022
• sangoma asterisk, certified asterisk +1 more A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9... CVE-2022-42705 Fix available 6.5 MediumDecember 5, 2022
• sangoma asterisk In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an... CVE-2022-37325 Fix available 7.5 HighDecember 5, 2022
• teluu pjsip, asterisk certified asterisk, debian linux +2 more +4 more Use after free in PJSIP CVE-2022-23608 Fix available 8.1 HighFebruary 22, 2022
• teluu pjsip, asterisk certified asterisk, debian linux +2 more +4 more Out-of-bounds read in multipart parsing in PJSIP CVE-2022-21723 Fix available 9.1 CriticalJanuary 27, 2022
• teluu pjsip, asterisk certified asterisk, debian linux +2 more +4 more Potential integer underflow upon receiving STUN message in PJSIP CVE-2021-37706 Fix available 7.3 HighDecember 22, 2021
• digium certified asterisk, sangoma asterisk +1 more A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before... CVE-2020-28327 Fix available 5.3 MediumNovember 6, 2020
• asterisk certified asterisk, sangoma asterisk, debian linux +1 more +3 more An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x... CVE-2020-28242 Fix available 6.5 MediumNovember 6, 2020
• asterisk, debian linux +1 more asterisk allows calls on prohibited networks CVE-2009-3723 Fix available 7.5 HighOctober 29, 2019
• sangoma asterisk An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk... CVE-2018-12228 6.5 MediumJune 12, 2018
• asterisk certified asterisk, sangoma asterisk +1 more A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x... CVE-2017-9358 Fix available 7.5 HighJune 2, 2017
• asterisk business edition, certified asterisk, digiumphones +2 more +4 more Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15... CVE-2012-2186 Fix available 9.0 HighAugust 31, 2012
• asterisk certified asterisk, open source, sangoma asterisk +2 more chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1... CVE-2012-2948 Fix available 4.0 MediumJune 2, 2012
• asterisk, asterisk open source, appliance s800i +1 more +3 more The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26... CVE-2009-2346 Fix available 7.8 HighSeptember 8, 2009