How many CVEs does asterisk have?

asterisk has 119 published CVE records since 2007, including 11 in the last two years.

How many asterisk CVEs are in CISA KEV?

None of asterisk's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which asterisk products have the most CVEs?

The asterisk products with the most published CVEs are asterisk, asterisk appliance developer kit, asterisknow, certified_asterisk, asterisk business edition.

What are the most common weakness types in asterisk CVEs?

asterisk's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-476 (NULL Pointer Dereference), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-20 (Improper Input Validation).

Are there public exploits for asterisk vulnerabilities?

Yes — 44 of asterisk's CVEs have a known public exploit.

How many critical asterisk vulnerabilities are there?

asterisk has 11 critical and 51 high-severity CVEs.

What is the average severity of asterisk CVEs?

The average CVSS base score across asterisk's scored CVEs is 6.8.

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Asterisk

RadicalNotion.AI

We do not sell or share your personal information.

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Asterisk

asterisk Vulnerabilities: CVEs, CISA KEV & Security Advisories

119 CVEs

asterisk Vulnerabilities

Name: asterisk vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for asterisk.

119

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

6.8

Avg CVSS

2007–2026

Overview

asterisk has 119 published CVE records since 2007, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 44 have a known public exploit. The average CVSS base score across scored CVEs is 6.8.

Security scorecard

A quick read on asterisk's vulnerability posture, as a share of its 119 published CVEs.

Average CVSS: 6.8
Critical / high: 52%
Actively exploited (KEV): 0%
Public exploit available: 37%
Patch available: 87%

Severity and exploitation

How the CVSS severity of asterisk's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical11

High51

Medium55

Low2

In CISA’s Known Exploited Vulnerabilities catalog

None of asterisk's CVEs are currently listed in CISA's KEV catalog.

Public exploits

44 of asterisk's CVEs have a known public exploit available.

Most affected products

The asterisk products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

asterisk93 CVEs
asterisk appliance developer kit13 CVEs
asterisknow13 CVEs
certified_asterisk11 CVEs
asterisk business edition11 CVEs
s800i7 CVEs

Common weakness types

The CWE weakness categories most often found in asterisk CVEs. Follow any weakness for its full explanation.

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer14 CVEs
CWE-476NULL Pointer Dereference8 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-20Improper Input Validation6 CVEs
CWE-3995 CVEs
CWE-287Improper Authentication

CNAs that assign these CVEs

The CVE Numbering Authorities that publish asterisk CVE records.

mitre98 CVEs
GitHub_M18 CVEs
redhat1 CVEs
Gridware1 CVEs
ibm1 CVEs

Disclosure activity by year

How many asterisk CVEs were published each year.

2019

2020

2021

2022

2023

2024

2025

Latest asterisk CVEs

The most recently disclosed vulnerabilities affecting asterisk.

ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
CWE-427
High · CVSS 8.8
EPSS 0.2%2026-02-06
Asterisk vulnerable to potential privilege escalation
CWE-427
High · CVSS 7.8
EPSS 0.1%2026-02-06
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
CWE-611
Medium · CVSS 6.5
EPSS 0.2%2026-02-06
The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization

Other vendors

CVE counts for other vendors.

matrix-org120 CVEs netscape120 CVEs chadhaajay119 CVEs code.gitea.io119 CVEs Crocoblock119 CVEs digium119 CVEs horde119 CVEs Johnson Controls119 CVEs

Browse all vendors

Frequently asked questions

Common questions about asterisk vulnerabilities.

How many CVEs does asterisk have?: asterisk has 119 published CVE records since 2007, including 11 in the last two years.
How many asterisk CVEs are in CISA KEV?: None of asterisk's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which asterisk products have the most CVEs?: The asterisk products with the most published CVEs are asterisk, asterisk appliance developer kit, asterisknow, certified_asterisk, asterisk business edition.
What are the most common weakness types in asterisk CVEs?: asterisk's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-476 (NULL Pointer Dereference), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-20 (Improper Input Validation).
Are there public exploits for asterisk vulnerabilities?: Yes — 44 of asterisk's CVEs have a known public exploit.
How many critical asterisk vulnerabilities are there?: asterisk has 11 critical and 51 high-severity CVEs.
What is the average severity of asterisk CVEs?: The average CVSS base score across asterisk's scored CVEs is 6.8.