CVE-2025-1131
High
Description
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.
SeverityHigh
CVSS7.8
Exploit probability—
ProductSangoma Asterisk
PublishedSep 23, 2025
First seenSep 23, 2025
Weakness typeCWE-427CWE-427
How to fix
Update
- sangoma asterisk18.26.3, 20.15.1, 21.10.1, 22.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sangoma asterisk | v < 18.26.3, 20.0.0 ≤ v < 20.15.1, 21.0.0 ≤ v < 21.10.1, 22.0.0 ≤ v < 22.5.1 | 18.26.3, 20.15.1, 21.10.1, 22.5.1 |
| sangoma certified_asterisk | 18.9, 20.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.