PT-2025-53800 · Asterisk+1 · Asterisk+1

Mowoe · Published 2025-12-29 · Updated 2025-12-30 · CVE-2025-69205

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Micro Registration Utility (µURU) versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893

Description The Micro Registration Utility (µURU), a telephone self registration utility based on asterisk, contains a flaw due to improper input validation. An attacker can craft a specific federation name, injecting characters treated specially by asterisk into the Dial() application. This allows redirection of calls on both federating instances. Successful exploitation requires an administrator to accept federation requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-20

Related Identifiers

CVE-2025-69205

GHSA-XVRH-PM3F-79V4

Affected Products

Micro Registration Utility

Asterisk

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69205.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69205 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69205 · Vendor Advisory
• https://github.com/olell/uURU/security/advisories/GHSA-xvrh-pm3f-79v4 · Note
• https://twitter.com/VulmonFeeds/status/2005798202830651845 · Twitter Post
• https://docs.asterisk.org/Latest_API/API_Documentation/Dialplan_Applications/Dial · Note
• https://t.me/CVEtracker/40884 · Telegram Post
• https://twitter.com/CVEnew/status/2005749628612845961 · Twitter Post