Unscored severity · published Mar 24, 2008
CVE-2008-1390
The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance…
–
CVSS
3.8%
EPSS
No
On KEV
Description
The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asterisk · Asterisk
1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; 1.4.6; +15 more · source: NVD
AA
Asterisk Appliance Developer Kit · Asterisk
0.2; 0.3; 0.4; 0.5; 0.6; 0.7; +2 more · source: NVD
AB
Asterisk Business Edition · Asterisk
c.1.0-beta7; c.1.0-beta8 · source: NVD
AS
Asterisknow · Asterisk
1.0; beta_5; beta_6; beta_7 · source: NVD
S8
S800i · Asterisk
1.0; 1.0.1; 1.0.2; 1.0.3; 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1390
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1390
downloads.digium.com
http://downloads.digium.com/pub/security/AST-2008-005.html
Vendor Advisory
http://secunia.com/advisories/29449
secunia.com
http://secunia.com/advisories/29470
securityreason.com
http://securityreason.com/securityalert/3764
www.securityfocus.com
http://www.securityfocus.com/archive/1/489819/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/28316
More from Asterisk
8.8
CVE-2024-42365
Asterisk is an open source private branch exchange (PBX) and telephony toolkit
8.2
CVE-2026-57191
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
8.1
CVE-2026-57202
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
7.7
CVE-2026-57197
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
7.5
CVE-2026-57186
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser