CVE-2021-26712

HIGH
Published Feb 18, 20215y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Feb 18, 2021 5y ago
Last Modified Jun 17, 2026 2w ago

Description

Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 17

VendorProductVersionRange
digiumasterisk*≥13.0.0  –  ≤13.38.2
digiumasterisk*≥16.0.0  –  <16.16.1
digiumasterisk*≥17.0.0  –  <17.9.2
digiumasterisk*≥18.0  –  <18.2.1
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any
digiumcertified_asterisk16.8any

References 5

  • packetstormsecurity.com http://packetstormsecurity.com/files/161473/Asterisk-Project-Security-Advisory-AST-2021-003.html
    Third Party Advisory
  • seclists.org http://seclists.org/fulldisclosure/2021/Feb/59
    Mailing ListThird Party Advisory
  • downloads.asterisk.org https://downloads.asterisk.org/pub/security/
    Vendor Advisory
  • downloads.asterisk.org https://downloads.asterisk.org/pub/security/AST-2021-003.html
    Vendor Advisory
  • issues.asterisk.org https://issues.asterisk.org/jira/browse/ASTERISK-29260
    Issue TrackingPatchVendor Advisory

Remediation

  • issues.asterisk.org https://issues.asterisk.org/jira/browse/ASTERISK-29260
    Issue TrackingPatchVendor Advisory