PT-2025-22514 · Sangoma+2 · Certified Asterisk+3

Published 2025-05-22 · Updated 2025-09-05 · CVE-2025-47780

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 18.26.2 Asterisk versions prior to 20.14.1 Asterisk versions prior to 21.9.1 Asterisk versions prior to 22.4.1 certified-asterisk versions prior to 18.9-cert14 certified-asterisk versions prior to 20.7-cert5

Description Asterisk is an open-source private branch exchange (PBX). The issue arises when trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring cli permissions.conf, which does not work as expected. This could lead to a security risk if an administrator relies on the cli permissions.conf file to deny all attempts to execute shell commands.

Recommendations For Asterisk versions prior to 18.26.2, update to version 18.26.2 or later. For Asterisk versions prior to 20.14.1, update to version 20.14.1 or later. For Asterisk versions prior to 21.9.1, update to version 21.9.1 or later. For Asterisk versions prior to 22.4.1, update to version 22.4.1 or later. For certified-asterisk versions prior to 18.9-cert14, update to version 18.9-cert14 or later. For certified-asterisk versions prior to 20.7-cert5, update to version 20.7-cert5 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2025-11102

CVE-2025-47780

DLA-4206-1

GHSA-C7P6-7MVQ-8JQ2

Affected Products

Alt Linux

Asterisk

Debian

Certified Asterisk

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47780.json · Exploit
• https://github.com/asterisk/asterisk/security/advisories/GHSA-c7p6-7mvq-8jq2 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4206-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47780 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47780 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-47780 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-47780 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-47780 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-47780 · Security Note
• https://twitter.com/VulmonFeeds/status/1925629545031319898 · Twitter Post
• https://twitter.com/Cezar_H_Linux/status/1929963253934780487 · Twitter Post
• https://twitter.com/CVEnew/status/1925601152101384512 · Twitter Post
• https://lists.debian.org/debian-lts-announce/2025/06/msg00003.html · Note