CVE-2014-4046: Digium Asterisk

Medium severity, CVSS 6.5. EPSS: 5.7% chance of exploitation in the next 30 days.

Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.

Affected products

• Digium Asterisk: version 11.0.0 only; version 11.0.1 only; version 11.0.2 only; version 11.1.0 only; version 11.1.1 only; version 11.1.2 only; …
• Digium Certified Asterisk: version 11.6 only; version 11.6.0 only

Published 2014-06-17. Last modified 2026-06-17.