en
The Asterisk Project develops Asterisk, a free and open-source framework for communications applications. It provides telephony building blocks for systems such as IP PBXs, VoIP gateways, interactive voice response systems, and conference servers, and is supported by a worldwide developer and integrator community.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-23741ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published02/06/2026 | SeverityInformational |
CVE-2026-23740Asterisk vulnerable to potential privilege escalation | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published02/06/2026 | SeverityHigh |
CVE-2026-23739Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published02/06/2026 | SeverityLow |
CVE-2026-23738The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published02/06/2026 | SeverityLow |
CVE-2025-1131Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published09/23/2025 | SeverityHigh |
CVE-2025-57767Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published08/28/2025 | SeverityHigh |
CVE-2025-54995Asterisk remotely exploitable leak of RTP UDP ports and internal resources | Exploitation statusPublic exploit | FixYes | Affected productasterisk | Published08/28/2025 | SeverityMedium |
CVE-2025-49832Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation | Exploitation statusPublic exploit | FixYes | Affected productasterisk | Published08/01/2025 | SeverityMedium |
CVE-2025-47780cli_permissions.conf: deny option does not work for disallowing shell commands | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published05/22/2025 | SeverityMedium |
CVE-2025-47779Using malformed From header can forge identity with ";" or NULL in name portion | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published05/22/2025 | SeverityHigh |
CVE-2024-42491A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used | Exploitation statusNot known exploited | FixNot confirmed | Affected productasterisk | Published09/05/2024 | SeverityMedium |
CVE-2024-42365Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published08/08/2024 | SeverityHigh |
CVE-2024-35190Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published05/17/2024 | SeverityMedium |
CVE-2023-49786Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published12/14/2023 | SeverityHigh |
CVE-2023-37457Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update' | Exploitation statusNot confirmed | FixYes | Affected productasterisk | Published12/14/2023 | SeverityHigh |
CVE-2023-49294Asterisk Path Traversal vulnerability | Exploitation statusNot confirmed | FixNot confirmed | Affected productasterisk | Published12/14/2023 | SeverityMedium |
CVE-2021-46837 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/30/2022 | SeverityUnknown |
CVE-2022-23608Use after free in PJSIP | Exploitation statusNot known exploited | FixYes | Affected productpjproject | Published02/22/2022 | SeverityHigh |
CVE-2022-21723Out-of-bounds read in multipart parsing in PJSIP | Exploitation statusNot known exploited | FixYes | Affected productpjproject | Published01/27/2022 | SeverityCritical |
CVE-2021-37706Potential integer underflow upon receiving STUN message in PJSIP | Exploitation statusNot confirmed | FixNot confirmed | Affected productpjproject | Published12/22/2021 | SeverityHigh |
CVE-2020-28242 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/06/2020 | SeverityUnknown |
CVE-2009-3723 | Exploitation statusNot confirmed | FixNot confirmed | Affected productasterisk | Published10/29/2019 | SeverityUnknown |
CVE-2017-9358 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/02/2017 | SeverityUnknown |
CVE-2013-2685 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/29/2013 | SeverityUnknown |
CVE-2013-2264 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/29/2013 | SeverityUnknown |
CVE-2013-2686 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/29/2013 | SeverityUnknown |
CVE-2012-2186 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/31/2012 | SeverityUnknown |
CVE-2012-2948 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/02/2012 | SeverityUnknown |
CVE-2012-2415 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/30/2012 | SeverityUnknown |
CVE-2012-2414 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/30/2012 | SeverityUnknown |
CVE-2012-2416 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/30/2012 | SeverityUnknown |
CVE-2012-0885 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/25/2012 | SeverityUnknown |
CVE-2011-4063 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2011 | SeverityUnknown |
CVE-2010-0441 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2010 | SeverityUnknown |
CVE-2009-2346 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/08/2009 | SeverityUnknown |
CVE-2009-0041 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/14/2009 | SeverityUnknown |
CVE-2008-5744 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/26/2008 | SeverityUnknown |
CVE-2008-5558 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2008 | SeverityUnknown |
CVE-2008-5396 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/09/2008 | SeverityUnknown |
CVE-2008-3903 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/04/2008 | SeverityUnknown |
CVE-2008-3264 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/24/2008 | SeverityUnknown |
CVE-2008-3263 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/22/2008 | SeverityUnknown |
CVE-2008-2543 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/05/2008 | SeverityUnknown |
CVE-2008-2119 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published06/04/2008 | SeverityUnknown |
CVE-2008-1923 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/23/2008 | SeverityUnknown |
CVE-2008-1897 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/23/2008 | SeverityUnknown |
CVE-2008-1390 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/24/2008 | SeverityUnknown |
CVE-2008-1289 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/24/2008 | SeverityUnknown |
CVE-2008-1332 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2008 | SeverityUnknown |
CVE-2008-1333 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2008 | SeverityUnknown |
CVE-2008-0095 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/08/2008 | SeverityUnknown |
CVE-2007-6430 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/20/2007 | SeverityUnknown |
CVE-2007-5690 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/29/2007 | SeverityUnknown |
CVE-2007-5488 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/17/2007 | SeverityUnknown |
CVE-2007-4521 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/28/2007 | SeverityUnknown |
CVE-2007-4455 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/22/2007 | SeverityUnknown |
CVE-2007-4280 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/09/2007 | SeverityUnknown |
CVE-2007-3765 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/18/2007 | SeverityUnknown |
CVE-2007-3762 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/18/2007 | SeverityUnknown |
CVE-2007-3763 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/18/2007 | SeverityUnknown |
CVE-2007-3764 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/18/2007 | SeverityUnknown |
CVE-2007-2488 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/07/2007 | SeverityUnknown |
CVE-2007-2293 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/26/2007 | SeverityUnknown |
CVE-2007-2297 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/26/2007 | SeverityUnknown |
CVE-2007-2294 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/26/2007 | SeverityUnknown |
CVE-2007-1595 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/22/2007 | SeverityUnknown |
CVE-2007-1594 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/22/2007 | SeverityUnknown |
CVE-2007-1561 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/21/2007 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
