The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade asterisk | Jul 30, 2024 | Apr 30, 2012 |
| Freebsd | — | Upgrade asterisk18Upgrade asterisk16Upgrade asterisk10 | Dec 10, 2025 | Apr 23, 2012 |
| Gentoo Linux | — | Upgrade net-misc/asterisk. | Oct 30, 2017 | Apr 30, 2012 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub