bluebox

Bluebox work in progress A collection of exploits for different VoIP products. Thanks to the Go Exploit Framework. If you ended up here looking for a VoIP pentesting solution, check out Sippts sippts-gui in Kali or SIPVicious. This project is more focused on the exploitation phase. Install git...

asterisk

The AsteriskR Open Source PBX By Mark Spencer and the Asterisk.org developer community. Copyright C 2001-2025 Sangoma Technologies Corporation and other copyright holders. SECURITY It is imperative that you read and fully understand the contents of the security information document before you...

email-prediction-asterisks

ASTERISKS & OBELIX Email prediction asterisks is a script that allows you to identify the emails hidden behind asterisks. It is a perfect application for osint analysts and security forces. It allows to intelligently predict, using Intelx leaks, which emails are related to the person we are looki...

sipcheck

SIPCheck v.3.0 はじめに SIPCheckは、Asteriskのユーザ認証を監視し、間違ったパスワードを使用して登録や発信を試みるユーザ（またはボット）を自動的に禁止するツールです。 Fail2Banとは異なり、SIPCheckは攻撃者だけでなく、信頼できることが証明されているクライアントも管理します。つまり、信頼できるSIPユーザがいる場合、間違ったパスワードを受け取っても禁止しません。なぜなら、そのIPの背後にいる多くのSIPクライアントも一緒に禁止されてしまう可能性があるからです。...

astDoS

astDoS Tool to exploit CVE-2018-7284 and CVE-2018-19278 Usage This tool is used as a command. astDoS.py -h -a 1,2 -sA SERVERIP -sP SERVERPORT -u USER -p PASSWD -sub SUBUSER -dA DNSIP -dP DNSPORT -v VERSION DoS attack against Astersisk, CVE-2018-7284 and CVE-2018-19278 optional arguments: -h, --he...

FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...

Issabel Authenticated - Remote Code Execution

A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asteriskcli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated...

BC-WHY-NOT-LEARN-NEW-STUFF-

BC-WHY-NOT-LEARN-NEW-STUFF- HACKING SIP/PJSIP crash remote asterisk instances : https://github.com/asterisk/asterisk/security/advisories/GHSA-v428-g3cw-7hv9...

CVE-2026-45562

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

EUVD-2026-88385

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562

The FreePBX Music on Hold (MoH) module is vulnerable to Authenticated Remote Code Execution in versions prior to 16.0.4 and 17.0.6 . The root cause is a lack of sanitization for a POST parameter that defines a custom Asterisk application . This unsanitized data is stored in the database and subse...

CVE-2026-45562: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-75600: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

htb-machine-ringdown

htb-machine-ringdown Ringdown（オリジナルのDebian/Asterisk脆弱性マシン）の詳細な設計・悪用解説書。CVE-2024-42365（AMI）、PJSIPプリハッシュクラッキング、Fail2ban POSIX ACL権限昇格を特集しています。...

EUVD-2026-39807

Podman: Malformed Image can trick podman run into leaking host environment variables into the container...

CVE-2026-89026

CVE-2026-89026 Issabel pbxapi JWT hardcodeado RCE POC Issabel Framework pbxapi — falsificación de JWT no autenticada clave HS256 hardcodeada y luego GET /pbxapi/manager/originate con Application=System para ejecutar comandos del sistema operativo como el usuario de Asterisk. Parcheado en el commi...

[SECURITY] Fedora 45 Update: asterisk-23.5.0-4.fc45

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...