CVE-2025-49832
Medium
Description
Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21.00.0, 22.00.0 through 22.5.0, there is a remote DoS and possible RCE condition in `asterisk/res/res_stir_shaken /verification.c` that can be exploited when an attacker can set an arbitrary Identity header, or STIR/SHAKEN is enabled, with verification set in the SIP profile associated with the endpoint to be attacked. This is fixed in versions 18.26.3, 20.7-cert6, 20.15.1, 21.10.1 and 22.5.1.
SeverityMedium
CVSS6.5
Exploit probability—
ProductSangoma Asterisk
PublishedAug 1, 2025
First seenAug 1, 2025
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- sangoma asterisk18.26.3, 20.15.1, 21.10.1, 22.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sangoma asterisk | v < 18.26.3, 20.0.0 ≤ v < 20.15.1, 21.0.0 ≤ v < 21.10.1, 22.0.0 ≤ v < 22.5.1 | 18.26.3, 20.15.1, 21.10.1, 22.5.1 |
| sangoma certified_asterisk | v ≤ 18.9, 20.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.