CVE-2017-14603: Digium Asterisk

High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days.

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.

Affected products

• Digium Asterisk: version 13.0.0 only; version 13.0.1 only; version 13.0.2 only; version 13.1.0 only; version 13.1.1 only; version 13.2.0 only; …
• Digium Certified Asterisk: version 11.6 only; version 13.13 only

Published 2017-10-10. Last modified 2026-06-17.