Search for vulnerabilities
Vulnerability details: VCID-bd3d-h2re-w3h1
Vulnerability ID VCID-bd3d-h2re-w3h1
Aliases CVE-2019-18790
Summary An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-862 Missing Authorization
System Score Found at
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
cvssv2 5.8 https://nvd.nist.gov/vuln/detail/CVE-2019-18790
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2019-18790
Reference id Reference type URL
http://downloads.asterisk.org/pub/security/AST-2019-006.html
https://api.first.org/data/v1/epss?cve=CVE-2019-18790
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18790
https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html
https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
https://www.asterisk.org/downloads/security-advisories
947381 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947381
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:cert1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:cert1:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:cert2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:cert2:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:cert3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:cert3:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:cert4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:cert4:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:rc1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2019-18790 https://nvd.nist.gov/vuln/detail/CVE-2019-18790
No exploits are available.
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-18790
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-18790
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.91342
EPSS Score 0.07418
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:38:17.976009+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.16/main.json 37.0.0