CVE-2014-4046: Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cer...

Security readout for executives and security teams

This flaw lets a logged-in Asterisk Manager user make affected Asterisk servers run arbitrary shell commands through MixMonitor. The attacker already needs valid Manager access, but successful abuse can turn a telephony admin account into server-level command execution. Organizations running old Asterisk 11/12 or Certified 11.6 builds should treat it as urgent if Manager access is exposed or shared. Exposure is likely limited to organizations still operating affected Asterisk versions with Asterisk Manager Interface accounts. Risk increases where Manager access is reachable over a network, credentials are shared, or Manager users have broad permissions. The provided bundle does not identify affected downstream appliances or packaged distributions. Prioritize remediation for internet-reachable or broadly accessible Asterisk Manager deployments. Although exploitation requires Manager credentials, successful abuse can execute shell commands on telephony infrastructure, creating outage, call-control, fraud, and lateral-movement risk. Older unsupported systems deserve extra attention because the affected versions are from 2014-era releases. Mitigation focus: Upgrade Asterisk Open Source 11.x to 11.10.1 or later.; Upgrade Asterisk Open Source 12.x to 12.3.1 or later.; Upgrade Certified Asterisk 11.6 to 11.6-cert3 or later..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.