Vulnerabilidades em Asterisk
37 resultadosAnálise Vexday
Asterisk apresenta perfil de risco baixo com apenas 1 CVE registrada na base, sem exploração ativa detectada (KEV) nem vulnerabilidades críticas. A fraqueza dominante identificada é CWE-427 (Uncontrolled Search Path Element), com vulnerabilidade sem atividade recente de ataque, indicando risco residual e previsível.
CVE-2023-49294MEDIUMAsterisk Path Traversal vulnerabilityEPSS 45.3%CVE-2023-49786HIGHAsterisk susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 5.3%CVE-2024-42365HIGHAsterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplanEPSS 4.7%CVE-2026-57193MEDIUMAsterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)EPSS 2.0%CVE-2009-3723—asterisk allows calls on prohibited networksEPSS 1.2%CVE-2023-37457HIGHAsterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'EPSS 1.1%CVE-2026-57200HIGHAsterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCEEPSS 0.9%CVE-2026-57198LOWAsterisk: Possible RED T.140 Heap Buffer OverflowEPSS 0.8%CVE-2026-57196LOWAsterisk: Reflected XSS in Phone Provisioning HTTP Error PagesEPSS 0.8%CVE-2026-57189LOWAsterisk: Possible RED T.140 Generation Accumulation OOB WriteEPSS 0.7%CVE-2026-57201HIGHAsterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte BufferEPSS 0.7%CVE-2026-57190HIGHAsterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype FieldEPSS 0.7%CVE-2026-57192MEDIUMAsterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count MismatchEPSS 0.7%CVE-2026-57186HIGHAsterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parserEPSS 0.6%CVE-2026-57191HIGHAsterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsingEPSS 0.6%CVE-2024-42491MEDIUMA malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is usedEPSS 0.6%CVE-2026-57195HIGHAsterisk: NULL Pointer Dereference in HTTP AMI Digest AuthenticationEPSS 0.6%CVE-2024-35190MEDIUMAsterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requestsEPSS 0.6%CVE-2026-57184MEDIUMAsterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)EPSS 0.6%CVE-2025-47779HIGHUsing malformed From header can forge identity with ";" or NULL in name portionEPSS 0.5%