PT-2025-39117 · Asterisk+1 · Asterisk+1

Abdul Mhanni · Published 2025-07-31 · Updated 2025-10-17 · CVE-2025-1131

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asterisk toolkit (affected versions not specified)

Description A local privilege escalation issue exists in the safe asterisk script. When Asterisk starts using this script, it executes all .sh files in the /etc/asterisk/startup.d/ directory as root without verifying ownership or permissions. Users with write access to /etc/asterisk can place malicious scripts in the startup.d directory, which will then run with root privileges when the service restarts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2025-13246

CVE-2025-1131

DLA-4326-1

GHSA-V9Q8-9J8M-5XWP

Affected Products

Asterisk

Debian

References · 17

• https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13246 · Security Note
• https://ubuntu.com/security/CVE-2025-1131 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1131 · Security Note
• https://osv.dev/vulnerability/DLA-4326-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1131 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1131 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-1131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1131 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-1131 · Vendor Advisory
• https://github.com/asterisk/asterisk/commit/f97361952023625e8dd49ca03454777fad19fedb · Note
• https://github.com/asterisk/asterisk/commit/7ba06dc6ee5efd4edfe79690ad8d61a33b92ce3d · Note
• https://t.me/avleonovcom/1596 · Telegram Post
• https://twitter.com/CVEnew/status/1970393452220186832 · Twitter Post
• https://t.me/cveNotify/136104 · Telegram Post