Local Privilege Escalation Vulnerability in Asterisk Toolkit by Asterisk

CVE-2025-1131

What is CVE-2025-1131?

A local privilege escalation issue has been identified in the safe_asterisk script bundled within the Asterisk toolkit. When initiated, this script executes all .sh files located in the /etc/asterisk/startup.d/ directory as the root user, without confirming their ownership or permissions. This flaw can be exploited by non-root users who have legitimate write access to /etc/asterisk. By placing malicious scripts in the startup.d directory, attackers can have these scripts executed with root privileges upon a service restart, thereby compromising the system's integrity.

References