CVE-2025-1131: asterisk before 18.26.3 (exclusive), from 20.0.0 (inclusive), before 20.15.1 (exclusive), from 21.0.0 (inclusive)…

Affected technology

asterisk · before 18.26.3 (exclusive)
sangoma

asterisk · from 20.0.0 (inclusive), before 20.15.1 (exclusive)
sangoma

asterisk · from 21.0.0 (inclusive), before 21.10.1 (exclusive)
sangoma

asterisk · from 22.0.0 (inclusive), before 22.5.1 (exclusive)
sangoma

certified asterisk · 18.9 · update cert1
sangoma

certified asterisk · 18.9 · update cert1-rc1
sangoma

certified asterisk · 18.9 · update cert10
sangoma

certified asterisk · 18.9 · update cert11
sangoma

certified asterisk · 18.9 · update cert12
sangoma

certified asterisk · 18.9 · update cert13
sangoma

certified asterisk · 18.9 · update cert14
sangoma

certified asterisk · 18.9 · update cert15
sangoma

certified asterisk · 18.9 · update cert2
sangoma

certified asterisk · 18.9 · update cert3
sangoma

certified asterisk · 18.9 · update cert4
sangoma

certified asterisk · 18.9 · update cert5
sangoma

certified asterisk · 18.9 · update cert6
sangoma

certified asterisk · 18.9 · update cert7
sangoma

certified asterisk · 18.9 · update cert8
sangoma

certified asterisk · 18.9 · update cert8-rc1
sangoma

certified asterisk · 18.9 · update cert8-rc2
sangoma

certified asterisk · 18.9 · update cert9
sangoma

certified asterisk · 20.7 · update cert1
sangoma

certified asterisk · 20.7 · update cert1-rc1
sangoma

certified asterisk · 20.7 · update cert1-rc2
sangoma

certified asterisk · 20.7 · update cert2
sangoma

certified asterisk · 20.7 · update cert3
sangoma

certified asterisk · 20.7 · update cert4
sangoma

certified asterisk · 20.7 · update cert5
sangoma

certified asterisk · 20.7 · update cert6
sangoma

Asterisk · Asterisk <=18.26.2, Asterisk <= 20.15.0, Asterisk <= 21.10.0, Asterisk <= 22.5.0
Asterisk

Component: safe_asterisk /etc/asterisk/startup.d
File: safe_asterisk

Attack conditions (Source advisory, CVSS 4.0): Local · Low privileges required · Passive user interaction

What an attacker can do

The source reports that an attacker could gain higher privileges under the conditions described by the source. Source advisory’s CVSS 4.0 assessment (base score 7.0/10) rates confidentiality, integrity and availability impact as high.