CVE-2008-1390: Asterisk

High severity, CVSS 9.3. EPSS: 3.8% chance of exploitation in the next 30 days.

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.

Affected products

• Asterisk Asterisk: version 1.4.1 only; version 1.4.2 only; version 1.4.3 only; version 1.4.4 only; version 1.4.5 only; version 1.4.6 only; …
• Asterisk Asterisk Appliance Developer Kit: version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; version 0.6 only; version 0.7 only; …
• Asterisk Asterisk Business Edition: version c.1.0-beta7 only; version c.1.0-beta8 only
• Asterisk Asterisknow: version 1.0 only; version beta_5 only; version beta_6 only; version beta_7 only
• Asterisk s800i: version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.1.0 only

Published 2008-03-24. Last modified 2026-06-16.