AS
Vendor
Asterisk
155
CVEs
0
On KEV
39
New 30D
Products
CE9.8
certified-asterisk
asterisk
30 CVEs0 on KEV19 new
AS8.8
asterisk
asterisk
41 CVEs0 on KEV20 new
OS–
Open Source
Asterisk
22 CVEs0 on KEV0 new
AA–
Asterisk Appliance Developer Kit
Asterisk
13 CVEs0 on KEV0 new
AS–
Asterisknow
Asterisk
13 CVEs0 on KEV0 new
AB–
Asterisk Business Edition
Asterisk
11 CVEs0 on KEV0 new
S8–
S800i
Asterisk
7 CVEs0 on KEV0 new
SA–
S800i Appliance
Asterisk
5 CVEs0 on KEV0 new
DI–
Digiumphones
Asterisk
3 CVEs0 on KEV0 new
ZA–
Zaptel
Asterisk
3 CVEs0 on KEV0 new
AS–
Asterisk-addons
Asterisk
2 CVEs0 on KEV0 new
BE–
Business Edition
Asterisk
2 CVEs0 on KEV0 new
AS–
Appliance S800i
Asterisk
1 CVEs0 on KEV0 new
OP–
Opensource
Asterisk
1 CVEs0 on KEV0 new
PB–
P B X
Asterisk
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-57199 New | CE certified-asterisk asterisk | 2.3 | Oct 27 | Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers |
| CVE-2026-57203 New | CE certified-asterisk asterisk | 6.9 | Oct 27 | Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location |
| CVE-2026-57190 New | CE certified-asterisk asterisk | 7.0 | Oct 27 | Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field |
| CVE-2026-57191 New | CE certified-asterisk asterisk | 8.2 | Oct 27 | Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing |
| CVE-2026-57192 New | AS asterisk asterisk | 6.0 | Oct 27 | Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch |
| CVE-2026-57186 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser |
| CVE-2026-57200 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE |
| CVE-2026-57195 New | CE certified-asterisk asterisk | 7.5 | Oct 27 | Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication |
| CVE-2026-57202 New | CE certified-asterisk asterisk | 8.1 | Oct 27 | Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes |
| CVE-2026-57188 New | CE certified-asterisk asterisk | 7.1 | Oct 27 | Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling |
| CVE-2026-57189 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Possible RED T.140 Generation Accumulation OOB Write |
| CVE-2026-57201 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer |
| CVE-2026-57194 New | AS asterisk asterisk | 5.9 | Oct 27 | Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk |
| CVE-2026-57198 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Possible RED T.140 Heap Buffer Overflow |
| CVE-2026-57185 New | AS asterisk asterisk | 6.5 | Oct 27 | Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser |
| CVE-2026-57197 New | AS asterisk asterisk | 7.7 | Oct 27 | Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex) |
| CVE-2026-57184 New | CE certified-asterisk asterisk | 6.3 | Oct 26 | Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon) |
| CVE-2026-57193 New | CE certified-asterisk asterisk | 6.9 | Oct 26 | Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure) |
| CVE-2026-57187 New | AS asterisk asterisk | 7.1 | Oct 26 | Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing |
| CVE-2026-57196 New | CE certified-asterisk asterisk | 2.3 | Oct 26 | Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages |
| CVE-2024-42491 | AS asterisk asterisk | 5.7 | Sep 5 | A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used |
| CVE-2024-42365 | AS Asterisk Asterisk | 8.8 | Aug 8 | Asterisk is an open source private branch exchange (PBX) and telephony toolkit |
| CVE-2021-46837 | CA Certified Asterisk Asterisk | 6.5 | Aug 30 | res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash… |
| CVE-2022-23608 | CA Certified Asterisk Asterisk | 9.8 | Feb 22 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE |
| CVE-2022-21723 | CA Certified Asterisk Asterisk | 9.1 | Jan 27 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE |
| CVE-2021-37706 | CA Certified Asterisk Asterisk | 9.8 | Dec 22 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE |
| CVE-2020-28242 | CA Certified Asterisk Asterisk | 6.5 | Nov 6 | An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5 |
| CVE-2017-9358 | CA Certified Asterisk Asterisk | 7.5 | Jun 2 | A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered… |
| CVE-2013-2686 | DI Digiumphones Asterisk | – | Apr 1 | main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and… |
| CVE-2013-2685 | OS Open Source Asterisk | – | Apr 1 | Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long… |
| CVE-2013-2264 | DI Digiumphones Asterisk | – | Apr 1 | The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business… |
| CVE-2012-2186 | OS Open Source Asterisk | – | Aug 31 | Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk… |
| CVE-2012-2948 | OS Open Source Asterisk | – | Jun 2 | chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1… |
| CVE-2012-2416 | OS Open Source Asterisk | – | Apr 30 | chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4, when the trustrpid… |
| CVE-2012-2415 | OS Open Source Asterisk | – | Apr 30 | Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows… |
| CVE-2012-2414 | OS Open Source Asterisk | – | Apr 30 | main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before… |
| CVE-2012-0885 | OS Open Source Asterisk | – | Jan 25 | chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote… |
| CVE-2011-4063 | OS Open Source Asterisk | – | Oct 21 | chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which… |
| CVE-2010-0441 | AS Asterisk Asterisk | – | Feb 4 | Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a… |
| CVE-2009-2346 | AS Asterisk Asterisk | – | Sep 8 | The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x… |
| CVE-2009-0041 | SA S800i Appliance Asterisk | – | Jan 14 | IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and… |
| CVE-2008-5744 | ZA Zaptel Asterisk | – | Dec 26 | Array index error in the dahdi/tor2.c driver in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by… |
| CVE-2008-5558 | AB Asterisk Business Edition Asterisk | – | Dec 17 | Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of… |
| CVE-2008-5396 | ZA Zaptel Asterisk | – | Dec 9 | Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value… |
| CVE-2008-3903 | PB P B X Asterisk | – | Sep 4 | Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and… |
| CVE-2008-3264 | AA Asterisk Appliance Developer Kit Asterisk | – | Jul 24 | The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x… |
| CVE-2008-3263 | AS Asterisk Asterisk | – | Jul 22 | The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before… |
| CVE-2008-2543 | AS Asterisk-addons Asterisk | – | Jun 5 | The ooh323 channel driver in Asterisk Addons 1.2.x before 1.2.9 and Asterisk-Addons 1.4.x before 1.4.7 creates a remotely accessible TCP port that is intended solely for localhost… |
| CVE-2008-2119 | AB Asterisk Business Edition Asterisk | – | Jun 4 | Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote… |
| CVE-2008-1923 | AA Asterisk Appliance Developer Kit Asterisk | – | Apr 23 | The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an… |
| CVE-2008-1897 | AA Asterisk Appliance Developer Kit Asterisk | – | Apr 23 | The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before… |
| CVE-2008-1390 | AS Asterisk Asterisk | – | Mar 24 | The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance… |
| CVE-2008-1289 | AA Asterisk Appliance Developer Kit Asterisk | – | Mar 24 | Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW… |
| CVE-2008-1332 | AS Asterisk Asterisk | – | Mar 20 | Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before… |
| CVE-2008-1333 | OS Open Source Asterisk | – | Mar 20 | Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly… |
| CVE-2008-0095 | AA Asterisk Appliance Developer Kit Asterisk | – | Jan 8 | The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4… |
| CVE-2007-6430 | AB Asterisk Business Edition Asterisk | – | Dec 20 | Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8, when using database-based registrations… |
| CVE-2007-5690 | ZA Zaptel Asterisk | – | Oct 29 | Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name (interface name) in the ifr_name field |
| CVE-2007-5488 | AS Asterisk-addons Asterisk | – | Oct 17 | Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the… |
| CVE-2007-4521 | AS Asterisk Asterisk | – | Aug 28 | Asterisk Open Source 1.4.5 through 1.4.11, when configured to use an IMAP voicemail storage backend, allows remote attackers to cause a denial of service via an e-mail with an… |