sipcheck

SIPCheck v.3.0 소개 SIPCheck는 Asterisk 사용자 인증을 감시하고, 사용자또는 봇가 잘못된 비밀번호로 등록하거나 통화를 시도하면 자동으로 차단하는 도구입니다. Fail2Ban과 달리, SIPCheck는 공격자뿐만 아니라 신뢰할 수 있는 클라이언트도 관리합니다. 따라서 신뢰할 수 있다고 입증된 SIP 사용자가 있는 경우, 잘못된 비밀번호가 수신되더라도 차단하지 않습니다. 그렇지 않으면 해당 IP 뒤에 있는 많은 SIP 클라이언트도 함께 차단될 수 있기 때문입니다. 이러한 이유로, 이전 버전에 비해 여러 기...

asterisk

AsteriskR オープンソースPBX By Mark Spencer and the Asterisk.org developer community. Copyright C 2001-2025 Sangoma Technologies Corporation and other copyright holders. セキュリティ Asteriskサーバの設定と実行を試みる前に、セキュリティ情報ドキュメントの内容を読み、完全に理解することが必須です。 詳細については重要なセキュリティ上の考慮事項を参照してください。 Asteriskとは？...

email-prediction-asterisks

ASTERISKS & OBELIX Email prediction asterisks 는 별표 뒤에 숨겨진 이메일을 식별할 수 있는 스크립트입니다. OSINT 분석가와 보안 조직에 완벽한 애플리케이션입니다. Intelx 유출 데이터를 사용하여 우리가 찾는 사람과 관련된 이메일을 지능적으로 예측할 수 있습니다. 또한 결과로 생성된 CSV 데이터셋을 통해 수동 분석을 위해 이메일에서 정보를 자동으로 얻을 수 있습니다. Twitter에서 별표로 표시된 이메일 예시 데모 설치 Python용 intelx 라이브러리를 설치해야 합니다. gi...

Issabel Authenticated - Remote Code Execution

A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asteriskcli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated...

bluebox

Bluebox 開発中 さまざまな VoIP 製品向けのエクスプロイト集です。Go Exploit Framework に感謝します。 VoIP 向けのペネトレーションテストソリューションを探してここにたどり着いた場合は、Sippts（Kali の sippts-gui）または SIPVicious をチェックしてみてください。このプロジェクトは、よりエクスプロイト段階に焦点を当てています。 インストール git clone https://github.com/jesusprubio/bluebox.git cd bluebox go mod tidy go mod vendor 使い...

htb-machine-ringdown

htb-machine-ringdown Ringdown（オリジナルのDebian/Asterisk脆弱性マシン）の詳細な設計・悪用解説書。CVE-2024-42365（AMI）、PJSIPプリハッシュクラッキング、Fail2ban POSIX ACL権限昇格を特集しています。...

astDoS

astDoS CVE-2018-7284 および CVE-2018-19278 を悪用するツール 使用方法 このツールはコマンドとして使用します。 astDoS.py -h -a 1,2 -sA SERVERIP -sP SERVERPORT -u USER -p PASSWD -sub SUBUSER -dA DNSIP -dP DNSPORT -v VERSION DoS attack against Astersisk, CVE-2018-7284 and CVE-2018-19278 optional arguments: -h, --help show this help...

FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...

[SECURITY] Fedora 45 Update: asterisk-23.5.0-5.fc45.1

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

BC-WHY-NOT-LEARN-NEW-STUFF-

BC-WHY-NOT-LEARN-NEW-STUFF- SIP/PJSIP ハッキング リモートの Asterisk インスタンスをクラッシュさせる : https://github.com/asterisk/asterisk/security/advisories/GHSA-v428-g3cw-7hv9...

CVE-2026-45562

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

EUVD-2026-88385

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562

The FreePBX Music on Hold (MoH) module is vulnerable to Authenticated Remote Code Execution in versions prior to 16.0.4 and 17.0.6 . The root cause is a lack of sanitization for a POST parameter that defines a custom Asterisk application . This unsanitized data is stored in the database and subse...

CVE-2026-45562: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-75600: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

EUVD-2026-39807

Podman: Malformed Image can trick podman run into leaking host environment variables into the container...

CVE-2026-89026

CVE-2026-89026 Issabel pbxapi JWT hardcodeado RCE POC Issabel Framework pbxapi — falsificación de JWT no autenticada clave HS256 hardcodeada y luego GET /pbxapi/manager/originate con Application=System para ejecutar comandos del sistema operativo como el usuario de Asterisk. Parcheado en el commi...