CVE-2025-47780 cli_permissions.conf: deny option does not work for disallowing shell commands
Asterisk fails to enforce CLI permission restrictions, allowing attackers to execute shell commands if administrators rely on specific deny configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47780?
CVE-2025-47780 is a medium-severity command injection vulnerability in asterisk, published on 22 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.
Weakness: CWE-78
Which versions are affected by CVE-2025-47780?
It affects 2 products.
Products include Sangoma Asterisk, Sangoma Certified Asterisk.
How do I fix CVE-2025-47780?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-47780 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47780 exists.
Other vulnerabilities in asterisk
- CVE-2024-57520 Path traversal in n/a
- CVE-2025-47779 Using malformed From header can forge identity with ";" or NULL in name portion
- CVE-2025-57767 Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request
- CVE-2022-37325 Memory corruption in n/a
- CVE-2025-1131 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
Sources
Also known as DEBIAN-CVE-2025-47780, GHSA-c7p6-7mvq-8jq2, UBUNTU-CVE-2025-47780.