CVE-2021-26712: High severity asterisk vulnerability
Incorrect access controls in ressrtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-26712?
CVE-2021-26712 is a vulnerability that allows a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets in Sangoma Asterisk and Certified Asterisk.
What is the severity of CVE-2021-26712?
CVE-2021-26712 has a severity value of 7.5, which is considered high.
Which software versions are affected by CVE-2021-26712?
Sangoma Asterisk versions 13.38.1, 16.16.0, 17.9.1, and 18.2.0, as well as Certified Asterisk version 16.8-cert5, are affected by CVE-2021-26712.
How can an attacker exploit CVE-2021-26712?
An attacker can exploit CVE-2021-26712 by replaying SRTP packets to prematurely terminate secure calls on vulnerable Sangoma Asterisk and Certified Asterisk systems.
Are there any references for CVE-2021-26712?
Yes, you can find more information about CVE-2021-26712 in the following references: [1] http://packetstormsecurity.com/files/161473/Asterisk-Project-Security-Advisory-AST-2021-003.html, [2] http://seclists.org/fulldisclosure/2021/Feb/59, [3] https://downloads.asterisk.org/pub/security/