Skip to content
OpenAdvisories
Medium WID-SEC-2026-2094 14 CVEs

Digium Certified Asterisk: Mehrere Schwachstellen

Published Jun 25, 2026 · Updated Nov 4, 2026 · Revision 5 · de-DE

Vendor: Digium Vendor: Fedora Product: Certified Asterisk Product: Linux Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Digium Certified Asterisk und Asterisk ausnutzen, um Speicherfehler und Denial-of-Service-Zustände auszulösen, Informationen offenzulegen, Sitzungen zu übernehmen, Sicherheitsmechanismen und Berechtigungen zu umgehen, beliebige SQL- oder LDAP-Abfragen auszuführen sowie unter bestimmten Voraussetzungen beliebigen Programmcode auszuführen.

Product

Certified Asterisk ist eine komplette Multiprotokoll Telefonanlage (PBX) auf Softwarebasis mit erweitertem Support.
Asterisk ist eine komplette Open Source Multiprotokoll Telefonanlage (PBX) auf Softwarebasis.

Vulnerabilities 14

  • High 8.1
    CVE-2026-57202

    Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • High 7.7
    CVE-2026-57197

    Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a he…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • High 7.5
    CVE-2026-57186

    Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser

    Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • High 7.5
    CVE-2026-57200

    Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, …

    asterisk certified-asterisk asterisk certified-asterisk Debian Ubuntu
  • High 7.5
    CVE-2026-57201

    Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur whe…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • High 7.1
    CVE-2026-57188

    Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP names…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • High 7.0
    CVE-2026-57190

    Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds`…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Medium 6.9
    CVE-2026-57193

    Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Medium 6.5
    CVE-2026-57185

    Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Medium 6.3
    CVE-2026-57184

    Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Medium 6.0
    CVE-2026-57192

    Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds w…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Low 2.3
    CVE-2026-57189

    Asterisk: Possible RED T.140 Generation Accumulation OOB Write

    Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing rem…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Low 2.3
    CVE-2026-57196

    Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in `phone provisio…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Low 2.3
    CVE-2026-57199

    Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers`…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu

Revision history

  1. #5

    Neue Updates von Fedora aufgenommen

  2. #4

    Neue Updates von Fedora aufgenommen

  3. #3

    Referenz(en) aufgenommen: EUVD-2026-111110, EUVD-2026-111221, EUVD-2026-111103, EUVD-2026-111345, EUVD-2026-111344, EUVD-2026-111220, EUVD-2026-111401, EUVD-2026-111396, EUVD-2026-111403, EUVD-2026-111394, EUVD-2026-111395

  4. #2

    Referenz(en) aufgenommen: EUVD-2026-110074, EUVD-2026-110305, EUVD-2026-110081

  5. #1

    Initiale Fassung

References