CVE-2015-3008: Asterisk SIP TLS certificate CN null byte allows server spoofing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityThe flaw requires a man-in-the-middle position and a CA-issued crafted certificate, and CVSS v2 rates it medium with only partial integrity impact.

What it is

Asterisk fails to properly handle a null byte in the Common Name (CN) field of an X.509 certificate when registering a SIP TLS device. A certificate issued by a legitimate CA with a crafted CN can therefore be accepted for a domain it should not match. This enables man-in-the-middle spoofing of arbitrary SSL servers in affected Asterisk deployments.

Impact

An attacker positioned on the network path can impersonate a legitimate SIP TLS server and intercept or alter traffic. The CVSS v2 vector shows partial integrity impact only, with no confidentiality or availability impact recorded.

Attack surface

Reached over the network during SIP TLS device registration; the CVSS vector AV:N/AC:M/Au:N indicates no authentication is required but exploitation depends on conditions such as a crafted CA-issued certificate and a man-in-the-middle position. No user interaction is indicated.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded. EPSS is 0.46156 (98.756th percentile), and references include a vendor advisory but no public exploit tag.

What to do

• Upgrade Asterisk Open Source to 1.8.32.3, 11.17.1, 12.8.2, or 13.3.2, or Certified Asterisk to 1.8.28-cert5, 11.6-cert11, or 13.1-cert2 as applicable.
• Apply the vendor advisory AST-2015-003 and any distribution backports for Asterisk packages.
• Restrict SIP TLS exposure to trusted networks and enforce certificate validation where possible.
• Monitor for unexpected certificate changes or SIP TLS registration anomalies.

Detection

• Inspect X.509 certificates presented to Asterisk for null bytes or malformed CN fields.
• Monitor SIP TLS registration logs for unexpected server identities or certificate mismatches.
• Use network monitoring to detect man-in-the-middle positioning on SIP TLS paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.