CVE-2012-2186: Asterisk Business Edition

High severity, CVSS 9.0. EPSS: 3.6% chance of exploitation in the next 30 days.

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.

Affected products

• Asterisk Business Edition: up to and including c.3.7.5; version c.3.0 only
• Asterisk Certified Asterisk: up to and including 1.8.11; version 1.8.11 only
• Asterisk Digiumphones: up to and including 10.7.0
• Asterisk Open Source: version 1.8.0 only; version 1.8.1 only; version 1.8.1.1 only; version 1.8.1.2 only; version 1.8.2 only; version 1.8.2.1 only; …
• Sangoma Asterisk: up to and including 1.8.15.0; up to and including 10.7.0

Published 2012-08-31. Last modified 2026-06-16.