Certified Asterisk

Vendor:

First CVE: Dec 5, 2022 · Active for 3 years

15

Total CVEs

More Total CVEs than 93% of tracked products

3.0

Avg CVEs / Year

Higher CVE frequency than 78% of tracked products

6.9

Avg CVSS

Higher Avg CVSS than 43% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Certified Asterisk over time

Volume of CVEsAvg CVSS Base Score

First CVE

Dec 5, 2022

3 years ago

Most Recent CVE

Feb 6, 2026

172 days ago

CVE Severity & Scoring

Certified Asterisk15 CVEs

60%

40%

All CVEs353,240 CVEs

45%

40%

11%

MediumHigh

Attack Vector

Local3 (20.0%)

Network12 (80.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low14 (93.3%)

High1 (6.7%)

Unknown0 (0.0%)

User Interaction

None11 (73.3%)

Unknown0 (0.0%)

Required4 (26.7%)

Privileges Required

Low8 (53.3%)

High1 (6.7%)

None6 (40.0%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (15 CVEs).

15 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2023-49294HIGH Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cer	Dec 14, 2023	7.5	43	NO	NO
CVE-2026-23741HIGH Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_cored	Feb 6, 2026	8.8	27	NO	NO
CVE-2025-1131HIGH A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV i	Sep 23, 2025	7.8	24	NO	NO
CVE-2026-23740HIGH Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb ini	Feb 6, 2026	7.8	23	NO	NO
CVE-2025-47780HIGH Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-as	May 22, 2025	7.8	23	NO	NO
CVE-2025-54995MEDIUM Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of	Aug 28, 2025	6.5	22	NO	NO
CVE-2025-49832MEDIUM Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21.00.0, 22.00.0 through	Aug 1, 2025	6.5	22	NO	NO
CVE-2023-37457HIGH Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-c	Dec 14, 2023	8.2	22	NO	NO
CVE-2022-42705MEDIUM A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of servi	Dec 5, 2022	6.5	22	NO	NO
CVE-2026-23739MEDIUM Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c p	Feb 6, 2026	6.5	21	NO	NO

View all 15 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (15 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (15 CVEs).

Media Mentions

Signals from CVEs in this product scope (15 CVEs).

Top CNAs Publishing CVEs For Certified Asterisk

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
20.7	9	7.1	0.3%
18.9	11	7.1	2.4%
16.8.0	4	7.3	13.0%
16.8	1	7.8	0.1%
13.13.0	4	7.3	13.0%