Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-47780

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.

Published

2025-05-22T17:15:24.890

Last Modified

2025-11-03T20:19:05.740

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-78
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sangoma asterisk < 18.26.2 Yes
Application sangoma asterisk < 20.14.1 Yes
Application sangoma asterisk < 21.9.1 Yes
Application sangoma asterisk < 22.4.1 Yes
Application sangoma certified_asterisk < 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 18.9 Yes
Application sangoma certified_asterisk 20.7 Yes
Application sangoma certified_asterisk 20.7 Yes
Application sangoma certified_asterisk 20.7 Yes
Application sangoma certified_asterisk 20.7 Yes
Application sangoma certified_asterisk 20.7 Yes
Application sangoma certified_asterisk 20.7 Yes
References