CVE-2014-6610

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-26 · updated 2026-06-17
Weakness: CWE-19

Description

Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application.

Affected products

Digium Asterisk: 11.0.0, 11.0.0-beta1, 11.0.0-beta2, 11.0.0-rc1, 11.0.0-rc2, 11.1.0 (+51)
Digium Certified Asterisk: 11.6-cert1, 11.6-cert2, 11.6-cert3, 11.6-cert4, 11.6-cert5, 11.6.0

References

http://downloads.asterisk.org/pub/security/AST-2014-010.html
http://downloads.asterisk.org/pub/security/AST-2014-010.html

Get alerted when CVE-2014-6610 or the next vulnerability affects your stack