CVE-2017-14603

—

CVSS 3.0

7.5 high

EPSS

3%p87

Published

Oct 10, 2017 (Oct 10, 2017)

Modified

Jun 17, 2026

Description

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.

Vendors: digium
Products: asterisk, certified asterisk
Weakness: CWE-200
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news0 stories

No ingested article mentions this CVE yet.