CVE-2018-7286

Asterisk is the software that runs many business phone systems (VoIP/PBX). This issue is like a disgruntled employee with a valid phone extension being able to slam the phone system's 'brain' into a crash by sending it a burst of malformed call-setup requests and hanging up abruptly. It doesn't let them steal calls or data — it just knocks the phone system offline until it's restarted.

This matters to you if you run a VoIP phone system built on Asterisk or Certified Asterisk (including systems packaged for Debian), especially on versions up to 13.19.1, 14.7.5, or 15.2.1. The attacker must already have a valid SIP account/login on your system — it is not exploitable by a random outsider with no credentials, so the real risk is from malicious or compromised internal users, resellers, or customers with SIP accounts.

This deserves prompt attention but isn't a drop-everything emergency: there's no confirmed real-world exploitation and it's not on any government list of actively-attacked bugs, but working exploit code is already public and media attention is rising, which increases the chance someone starts using it. Because it also requires a valid login rather than being open to anyone on the internet, treat it as a scheduled patch, not a fire drill.

1. Identify your exact Asterisk/Certified Asterisk version (affected: Asterisk through 13.19.1, 14.x through 14.7.5, 15.x through 15.2.1; Certified Asterisk through 13.18-cert2).
2. Review the vendor advisory AST-2018-005 (http://downloads.asterisk.org/pub/security/AST-2018-005.html) and the tracking ticket ASTERISK-27618 for the exact patched release numbers for your branch.
3. Upgrade res_pjsip-affected systems to the fixed release noted in the advisory for your version branch (13.x, 14.x, 15.x, or Certified 13.18-cert2 successor).
4. If immediate patching isn't possible, mitigate by tightly restricting SIP/PJSIP account provisioning and credentials, monitoring for abnormal INVITE floods followed by abrupt TCP/TLS disconnects, and limiting TCP/TLS SIP transport exposure to trusted peers where feasible.
5. No CISA KEV listing exists, so there is no federal remediation deadline, but given the public exploit and rising press attention, schedule the upgrade within your normal patch cycle rather than deferring indefinitely.
6. After patching, monitor Asterisk logs for segmentation faults or unexpected res_pjsip restarts as a sign of attempted exploitation.

CVSS 3.0 score 6.5 (Medium), vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H — network-exploitable, low complexity, requires low-privilege authentication, no user interaction, impact limited to availability (crash) with no confidentiality or integrity loss. Weakness classification is unspecified (CWE-NVD-noinfo). One public exploit is known to exist, and EPSS places predicted exploitation likelihood in the 99th percentile with a flat trend, though no KEV listing or confirmed in-the-wild exploitation exists yet, so treat the EPSS figure as a prediction only. Vendor remediation is documented in AST-2018-005 and tracked under ASTERISK-27618.