VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Nov 22, 2019· Updated Jun 17, 2026

CVE-2019-18790

CVE-2019-18790

Description

An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

12
  • Digium/Asterisk
    cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
    Range: >=13.0.0,<13.29.2
  • Digium/Certified Asterisk6 versions
    cpe:2.3:a:digium:certified_asterisk:13.21.0:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:digium:certified_asterisk:13.21.0:*:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:13.21.0:cert1:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:13.21.0:cert2:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:13.21.0:cert3:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:13.21.0:cert4:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:13.21.0:rc1:*:*:*:*:*:*
  • Debian/linux2 versions
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • Sangoma/Asteriskdescription
  • Freepbx/Certified Asteriskllm-create
    Range: <cert5
  • Freepbx/Asteriskllm-create
    Range: <13.29.2, <16.6.2, <17.0.1

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.