CVE-2018-17281

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.07.5High EPSS percentile99th52% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2018-09-24Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Digium AsteriskAffected: ≥ 13.0.0, ≤ 13.23.0Upgrade to: after 13.23.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check the installed Asterisk version and whether the res_http_websocket.so module is enabled.
Upgrade to Asterisk 13.23.1, 14.7.8, or 15.6.1 or later; Certified Asterisk should be updated past 13.21-cert2 using the vendor-supported release.
If an update must wait, disable the WebSocket module or restrict its web interface to trusted networks.
Confirm the phone service starts normally and place inbound and outbound test calls after the change.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

In plain language

Written by AI from the record

Asterisk phone systems through 13.23.0, 14.7.7, and 15.6.0 can be remotely crashed, so affected small businesses should schedule an update promptly.

Unauthenticated network denial of service in Asterisk’s res_http_websocket.so WebSocket-upgrade handling allows crafted HTTP requests to exhaust stack space and crash the service.

If you're affected

Phone service outage
Call handling disruption
Customer support interruption
Emergency call-routing risk

What is it

This is a flaw in part of an Asterisk phone system that handles certain web connections. A stranger on the internet can send a specially formed request that makes the system fall over, like repeatedly overloading a receptionist’s desk until calls can no longer be handled.

Who is affected

This matters if your business runs Asterisk for phone calls, call queues, voicemail, or related communications. It is a risk when the WebSocket module is enabled; no attacker login or employee action is needed.

How urgent is it

A public exploit is available, so treat this as an amber-priority operational risk and plan the update promptly. It is not listed in CISA’s known-exploited catalog, but an exposed affected phone system can be knocked offline remotely.

What to do — in detail

Confirm the running version with your normal Asterisk package or administration tooling, then verify whether res_http_websocket.so is loaded or configured. Affected upstream branches should move to 13.23.1 or later, 14.7.8 or later, or 15.6.1 or later; Certified Asterisk installations should obtain the vendor-supported release later than 13.21-cert2. Review release notes and test call routing, WebSocket-dependent integrations, voicemail, and queue functions after upgrading. If maintenance must be delayed, disable res_http_websocket.so where it is not required or limit access to the HTTP/WebSocket service to trusted addresses. No CISA KEV remediation due date applies. Watch Asterisk service logs and availability monitoring for unexpected restarts or repeated malformed WebSocket-upgrade requests.

Technical context

CVSS v3.0 is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue is CWE-400: crafted HTTP requests initiating a WebSocket upgrade in res_http_websocket.so cause excessive stack consumption, producing unauthenticated remote denial of service. One public exploit is known. EPSS is 53.4% (99th percentile) and falling. CVE-2018-17281 is not in CISA KEV, so there is no confirmed KEV exploitation status or KEV due date.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

52% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-29EPSS band changehigh → moderate

Affected products

digiumcommercial · USaka asterisk
- asteriskCommunications
- certified asteriskCommunications
debianoss-project · GBaka debian gnu/linux
- debian linuxOSOn-premOperating Systems / linux-distro

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable