asterisk vulnerabilities and threats

CVE-2025-54995 affects Asterisk, an open source telephony toolkit, where prior to versions 18.26.4 and 18.9-cert17, improper session termination can cause RTP UDP ports and internal resources to leak. This leads to potential resource exhaustion. The issue has been addressed in the specified fixed versions.

CVE-2025-47780 is an OS command injection vulnerability in Asterisk PBX software where the cli_permissions.conf configuration intended to deny shell command execution via the CLI does not function correctly in affected versions. This flaw could allow an administrator who relies on cli_permissions.conf to be bypassed, potentially leading to unauthorized shell command execution. The issue is fixed in Asterisk versions 18.26.2, 20.14.1, 21.9.1, 22.4.1 and certified-asterisk versions 18.9-cert14 and 20.7-cert5.

CVE-2025-47779 is a vulnerability in Asterisk PBX software affecting SIP MESSAGE request authentication prior to certain fixed versions. Authenticated attackers can spoof user identities to send spam messages appearing from trusted users, potentially enabling social engineering and phishing attacks. The issue is fixed in versions 18.26.2, 20.14.1, 21.9.1, 22.4.1, 18.9-cert14, and 20.7-cert5.

CVE-2024-42491 is a vulnerability in Asterisk PBX prior to versions 18.24.3, 20.9.3, 21.4.3, and certain certified versions. When Asterisk sends a SIP request to a URI with a host starting with `.1` or `[.1]` while the res_resolver_unbound module is loaded, it crashes with a segmentation fault. The issue is fixed in the specified versions. Workarounds include disabling the res_resolver_unbound module or setting rewrite_contact to yes on all PJSIP endpoints, though these may not suit all configurations.

CVE-2024-42365 is a high-severity vulnerability in Asterisk PBX software that allows an AMI user with write=originate privileges to modify all configuration files in /etc/asterisk/. This is due to unsafe handling of remote file downloads and file append operations via the FILE function in the SET application. The flaw can lead to privilege escalation, remote code execution, and blind server-side request forgery. Fixed versions include 18.24.2, 20.9.2, 21.4.2, and corresponding certified-asterisk releases.