CVE-2019-18610: Debian Linux

High severity, CVSS 8.8. EPSS: 50.1% chance of exploitation in the next 30 days.

An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Digium Asterisk: from 13.0.0, before 13.29.2 (fixed in 13.29.2); from 16.0.0, before 16.6.2 (fixed in 16.6.2); from 17.0.0, before 17.0.1 (fixed in 17.0.1)
• Digium Certified Asterisk: version 13.21.0 only

Published 2019-11-22. Last modified 2026-06-17.