What’s Vulnerable › Vulnerabilities

CVE-2012-2186

• Severity: critical (CVSS 9.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-08-31 · updated 2026-06-16

Description

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.

Affected products

• asterisk Business Edition: through c.3.7.5; c.3.0
• asterisk Certified Asterisk: through 1.8.11; 1.8.11-cert, 1.8.11-cert1, 1.8.11-cert2, 1.8.11-cert3, 1.8.11-cert4
• asterisk Digiumphones: through 10.7.0
• asterisk Open Source: 1.8.0, 1.8.0-beta1, 1.8.0-beta2, 1.8.0-beta3, 1.8.0-beta4, 1.8.0-beta5 (+100)
• asterisk: through 1.8.15.0; through 10.7.0

References

• http://downloads.asterisk.org/pub/security/AST-2012-012.html
• http://secunia.com/advisories/50687
• http://secunia.com/advisories/50756
• http://www.debian.org/security/2012/dsa-2550
• http://www.securitytracker.com/id?1027460
• http://downloads.asterisk.org/pub/security/AST-2012-012.html
• http://secunia.com/advisories/50687
• http://secunia.com/advisories/50756
• http://www.debian.org/security/2012/dsa-2550
• http://www.securitytracker.com/id?1027460

Get alerted when CVE-2012-2186 or the next vulnerability affects your stack