CVE-2025-47780
Description
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.
How to fix
- sangoma asterisk18.26.2, 20.14.1, 21.9.1, 22.4.1 or later
- sangoma certified_asterisk18.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sangoma asterisk | v < 18.26.2, 20.0.0 ≤ v < 20.14.1, 21.0.0 ≤ v < 21.9.1, 22.0.0 ≤ v < 22.4.1 | 18.26.2, 20.14.1, 21.9.1, 22.4.1 |
| sangoma certified_asterisk | v < 18.9, 18.9, 20.7 | 18.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.