VulnerabilityModified
CVE-2019-18610
A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
HIGH 8.8EPSS 29.6%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 29.6%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 29.64% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- digium/asterisk · digium/certified asterisk · debian/debian linux
- Source
- cve@mitre.org
References
- http://downloads.asterisk.org/pub/security/AST-2019-007.htmlPatch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/11/msg00038.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/04/msg00001.htmlMailing List, Third Party Advisory
- https://www.asterisk.org/downloads/security-advisoriesVendor Advisory
- http://downloads.asterisk.org/pub/security/AST-2019-007.htmlPatch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/11/msg00038.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/04/msg00001.htmlMailing List, Third Party Advisory
- https://www.asterisk.org/downloads/security-advisoriesVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.