CVE-2010-0685: The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Busi...

Security readout for executives and security teams

This issue affects Asterisk deployments whose dialplan uses ${EXTEN} with wildcard pattern matching. An attacker who can influence the extension value, such as through SIP signaling, may cause unintended dialplan behavior, including an extra outbound call leg. Business risk depends heavily on the local dialplan and calling permissions. Most likely exposed systems are legacy Asterisk PBXs using wildcard dialplan patterns, ${EXTEN}, SIP access, and Dial or similar applications that can create outbound channels. Systems not using this dialplan pattern may not be affected. Prioritize assessment if legacy Asterisk systems can receive untrusted SIP traffic or place outbound calls. The main business concern is unauthorized call routing or toll exposure, but the available evidence does not confirm broad active exploitation. Mitigation focus: Review Digium AST-2010-002 and vendor package advisories for supported fixes.; Audit dialplans for ${EXTEN} use inside wildcard pattern matches.; Apply Asterisk filtering functions where attacker-influenced values enter dialplan logic..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.