Improper Authentication in Asterisk PBX Affects User Messaging
CVE-2025-47779

7.7HIGH

Key Information:

Vendor

Asterisk

Status
Asterisk
Vendor
CVE Published:
22 May 2025

What is CVE-2025-47779?

An improper authentication vulnerability has been identified in Asterisk PBX that allows authenticated attackers to exploit SIP requests of the type MESSAGE (RFC 3428). This flaw enables attackers to spoof user identities and send deceptive messages that appear to originate from trusted sources. Consequently, even those adhering to best security practices can find their systems compromised. This abuse not only facilitates the sending of spam but also paves the way for social engineering attacks and phishing attempts. The issue has been addressed in Asterisk versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1, as well as Certified-Asterisk versions 18.9-cert14 and 20.7-cert5.

Affected Version(s)

asterisk < 18.9-cert14 < 18.9-cert14

asterisk >= 18.10, < 18.26.2 < 18.10, 18.26.2

asterisk >= 20.0, < 20.7-cert5 < 20.0, 20.7-cert5

References

https://github.com/asterisk/asterisk/security/advisories/...
x_refsource_CONFIRM
https://github.com/asterisk/asterisk/blob/master/configs/...
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.