Login Request a demo
AS
Vendor
Asterisk
15 products with CVEs on record
166
CVEs
0
On KEV
39
New 30D
Products
CE
certified-asterisk
asterisk
9.8
30 CVEs0 on KEV19 new
AS
asterisk
asterisk
8.8
52 CVEs0 on KEV20 new
OS
Open Source
Asterisk
–
22 CVEs0 on KEV0 new
AA
Asterisk Appliance Developer Kit
Asterisk
–
13 CVEs0 on KEV0 new
AS
Asterisknow
Asterisk
–
13 CVEs0 on KEV0 new
AB
Asterisk Business Edition
Asterisk
–
11 CVEs0 on KEV0 new
S8
S800i
Asterisk
–
7 CVEs0 on KEV0 new
SA
S800i Appliance
Asterisk
–
5 CVEs0 on KEV0 new
DI
Digiumphones
Asterisk
–
3 CVEs0 on KEV0 new
ZA
Zaptel
Asterisk
–
3 CVEs0 on KEV0 new
AS
Asterisk-addons
Asterisk
–
2 CVEs0 on KEV0 new
BE
Business Edition
Asterisk
–
2 CVEs0 on KEV0 new
AS
Appliance S800i
Asterisk
–
1 CVEs0 on KEV0 new
OP
Opensource
Asterisk
–
1 CVEs0 on KEV0 new
PB
P B X
Asterisk
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-57199
New
CE
certified-asterisk
asterisk
2.3
0%
Oct 27Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
CVE-2026-57203
New
CE
certified-asterisk
asterisk
6.9
0%
Oct 27Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location
CVE-2026-57190
New
AS
asterisk
asterisk
7.0
1%
Oct 27Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
CVE-2026-57191
New
AS
asterisk
asterisk
8.2
1%
Oct 27Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
CVE-2026-57192
New
CE
certified-asterisk
asterisk
6.0
1%
Oct 27Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
CVE-2026-57186
New
AS
asterisk
asterisk
7.5
1%
Oct 27Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
CVE-2026-57200
New
AS
asterisk
asterisk
7.5
1%
Oct 27Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
CVE-2026-57195
New
AS
asterisk
asterisk
7.5
1%
Oct 27Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
CVE-2026-57202
New
CE
certified-asterisk
asterisk
8.1
0%
Oct 27Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57188
New
AS
asterisk
asterisk
7.1
1%
Oct 27Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57189
New
CE
certified-asterisk
asterisk
2.3
1%
Oct 27Asterisk: Possible RED T.140 Generation Accumulation OOB Write
CVE-2026-57201
New
CE
certified-asterisk
asterisk
7.5
1%
Oct 27Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
CVE-2026-57194
New
AS
asterisk
asterisk
5.9
0%
Oct 27Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
CVE-2026-57198
New
CE
certified-asterisk
asterisk
2.3
1%
Oct 27Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57185
New
AS
asterisk
asterisk
6.5
0%
Oct 27Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57197
New
CE
certified-asterisk
asterisk
7.7
1%
Oct 27Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57184
New
AS
asterisk
asterisk
6.3
1%
Oct 26Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
CVE-2026-57193
New
CE
certified-asterisk
asterisk
6.9
2%
Oct 26Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
CVE-2026-57187
New
CE
certified-asterisk
asterisk
7.1
0%
Oct 26Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
CVE-2026-57196
New
AS
asterisk
asterisk
2.3
1%
Oct 26Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages
CVE-2026-23741
AS
asterisk
asterisk
8.8
0%
Feb 6ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
CVE-2026-23740
AS
asterisk
asterisk
7.8
0%
Feb 6Asterisk vulnerable to potential privilege escalation
CVE-2026-23739
AS
asterisk
asterisk
6.5
0%
Feb 6Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
CVE-2026-23738
AS
asterisk
asterisk
6.1
0%
Feb 6The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
CVE-2025-1131
AS
Asterisk
Asterisk
7.8
0%
Sep 23Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
CVE-2025-57767
AS
asterisk
asterisk
7.5
0%
Aug 28Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request
CVE-2025-54995
AS
asterisk
asterisk
6.5
1%
Aug 28Asterisk remotely exploitable leak of RTP UDP ports and internal resources
CVE-2025-49832
AS
asterisk
asterisk
6.5
0%
Aug 1Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation
CVE-2025-47780
AS
asterisk
asterisk
7.8
0%
May 22cli_permissions.conf: deny option does not work for disallowing shell commands
CVE-2025-47779
AS
asterisk
asterisk
6.5
1%
May 22Using malformed From header can forge identity with ";" or NULL in name portion
CVE-2024-42491
AS
asterisk
asterisk
5.7
1%
Sep 5A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
CVE-2024-42365
AS
asterisk
asterisk
8.8
5%
Aug 8Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan
CVE-2024-35190
AS
asterisk
asterisk
5.3
1%
May 17Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests
CVE-2021-46837
CA
Certified Asterisk
Asterisk
6.5
5%
Aug 30res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash…
CVE-2022-23608
CA
Certified Asterisk
Asterisk
9.8
4%
Feb 22PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
CVE-2022-21723
CA
Certified Asterisk
Asterisk
9.1
4%
Jan 27PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
CVE-2021-37706
CA
Certified Asterisk
Asterisk
9.8
5%
Dec 22PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
CVE-2020-28242
CA
Certified Asterisk
Asterisk
6.5
2%
Nov 6An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5
CVE-2017-9358
CA
Certified Asterisk
Asterisk
7.5
3%
Jun 2A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered…
CVE-2013-2686
DI
Digiumphones
Asterisk
–
2%
Apr 1main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and…
CVE-2013-2685
OS
Open Source
Asterisk
–
3%
Apr 1Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long…
CVE-2013-2264
DI
Digiumphones
Asterisk
–
1%
Apr 1The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business…
CVE-2012-2186
OS
Open Source
Asterisk
–
4%
Aug 31Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk…
CVE-2012-2948
CA
Certified Asterisk
Asterisk
–
2%
Jun 2chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1…
CVE-2012-2416
OS
Open Source
Asterisk
–
2%
Apr 30chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4, when the trustrpid…
CVE-2012-2415
OS
Open Source
Asterisk
–
3%
Apr 30Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows…
CVE-2012-2414
OS
Open Source
Asterisk
–
3%
Apr 30main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before…
CVE-2012-0885
OS
Open Source
Asterisk
–
2%
Jan 25chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote…
CVE-2011-4063
OS
Open Source
Asterisk
–
2%
Oct 21chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which…
CVE-2010-0441
AS
Asterisk
Asterisk
–
3%
Feb 4Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a…
CVE-2009-2346
OP
Opensource
Asterisk
–
3%
Sep 8The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x…
CVE-2009-0041
AB
Asterisk Business Edition
Asterisk
–
3%
Jan 14IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and…
CVE-2008-5744
ZA
Zaptel
Asterisk
–
0%
Dec 26Array index error in the dahdi/tor2.c driver in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by…
CVE-2008-5558
AB
Asterisk Business Edition
Asterisk
–
2%
Dec 17Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of…
CVE-2008-5396
ZA
Zaptel
Asterisk
–
0%
Dec 9Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value…
CVE-2008-3903
PB
P B X
Asterisk
–
2%
Sep 4Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and…
CVE-2008-3264
AA
Asterisk Appliance Developer Kit
Asterisk
–
3%
Jul 24The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x…
CVE-2008-3263
AS
Asterisk
Asterisk
–
28%
Jul 22The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before…
CVE-2008-2543
AS
Asterisk-addons
Asterisk
–
4%
Jun 5The ooh323 channel driver in Asterisk Addons 1.2.x before 1.2.9 and Asterisk-Addons 1.4.x before 1.4.7 creates a remotely accessible TCP port that is intended solely for localhost…
CVE-2008-2119
AB
Asterisk Business Edition
Asterisk
–
7%
Jun 4Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote…