PT-2025-35098 · Asterisk+1 · Asterisk+1

Pc-M · Published 2025-08-28 · Updated 2025-10-20 · CVE-2025-57767

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.15.2 Asterisk versions prior to 21.10.2 Asterisk versions prior to 22.5.2

Description Asterisk is an open source private branch exchange and telephony toolkit. If a Session Initiation Protocol (SIP) request is received with an Authorization header containing a realm not present in a previous 401 response’s WWW-Authenticate header, or an incorrect realm is received without a prior 401 response, the get authorization header() function in res pjsip authenticator digest returns a NULL value. This lack of validation before attempting to retrieve the digest algorithm from the header results in a segmentation fault (SEGV).

Recommendations Update Asterisk to version 20.15.2 or later. Update Asterisk to version 21.10.2 or later. Update Asterisk to version 22.5.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-253

Related Identifiers

CVE-2025-57767

GHSA-64QC-9X89-RX5J

Affected Products

Asterisk

Debian

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57767.json · Exploit
• https://github.com/asterisk/asterisk/pull/1407 · Patch
• https://github.com/asterisk/asterisk/commit/02993717b08f899d4aca9888062f35dfb198584f · Patch
• https://github.com/asterisk/asterisk/security/advisories/GHSA-64qc-9x89-rx5j · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-57767 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-57767 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-57767 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-57767 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57767 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-57767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57767 · Security Note
• https://t.me/cveNotify/139468 · Telegram Post
• https://t.me/CVEtracker/31136 · Telegram Post
• https://twitter.com/CVEnew/status/1961101308062285969 · Twitter Post