What’s Vulnerable › Products

Sangoma Certified Asterisk vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your Sangoma Certified Asterisk version is affected

Latest Sangoma Certified Asterisk vulnerabilities

• CVE-2026-23741 — ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation (CVSS 8.8)
• CVE-2026-23740 — Asterisk vulnerable to potential privilege escalation (CVSS 7.8)
• CVE-2026-23739 — Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection (CVSS 6.5)
• CVE-2026-23738 — The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization (CVSS 6.1)
• CVE-2025-1131 — Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation (CVSS 7.8)
• CVE-2025-54995 — Asterisk remotely exploitable leak of RTP UDP ports and internal resources (CVSS 6.5)
• CVE-2025-49832 — Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation (CVSS 6.5)
• CVE-2025-47780 — cli_permissions.conf: deny option does not work for disallowing shell commands (CVSS 7.8)
• CVE-2025-47779 — Using malformed From header can forge identity with ";" or NULL in name portion (CVSS 6.5)
• CVE-2024-42491 — A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used (CVSS 5.7)
• CVE-2023-49786 — Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation (CVSS 5.9)
• CVE-2023-49294 — Asterisk Path Traversal vulnerability (CVSS 7.5)
• CVE-2023-37457 — Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update' (CVSS 8.2)
• CVE-2022-42706 — (CVSS 4.9)
• CVE-2022-42705 — (CVSS 6.5)