CVE-2017-7617: Digium Asterisk

High severity, CVSS 8.8. EPSS: 6.2% chance of exploitation in the next 30 days.

Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action.

Affected products

• Digium Asterisk: version 13.0.0 only; version 13.0.1 only; version 13.0.2 only; version 13.1.0 only; version 13.1.1 only; version 13.2.0 only; …
• Digium Certified Asterisk: up to and including 13.13-cert2

Published 2017-04-10. Last modified 2026-06-17.