Asterisk up to 22.4.0 Command Line Interface cli_permissions.conf os command injection

Summaryinfo

A vulnerability classified as critical has been found in Asterisk up to 22.4.0. This affects an unknown part of the file cli_permissions.conf of the component Command Line Interface. This manipulation causes os command injection. This vulnerability is registered as CVE-2025-47780. The attack needs to be launched locally. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Asterisk up to 22.4.0. Affected by this vulnerability is some unknown processing of the file cli_permissions.conf of the component Command Line Interface. The manipulation with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-47780 since 05/09/2025. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 237665 (Debian dla-4206 : asterisk - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 18.9-cert14, 18.26.2, 20.7-cert5, 20.14.1, 21.9.1 or 22.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (237665). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Communications System

Name

• Asterisk

Version

• 18.9-cert13
• 18.26.0
• 18.26.1
• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.7-cert4
• 20.8
• 20.9
• 20.10
• 20.11
• 20.12
• 20.13
• 20.14.0
• 21.0
• 21.1
• 21.2
• 21.3
• 21.4
• 21.5
• 21.6
• 21.7
• 21.8
• 21.9.0
• 22.0
• 22.1
• 22.2
• 22.3
• 22.4.0

Website

• Product: https://github.com/asterisk/asterisk/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion