Asterisk up to 22.4.0 SIP Request delimiter

Summaryinfo

A vulnerability classified as problematic was found in Asterisk up to 22.4.0. This vulnerability affects unknown code of the component SIP Request Handler. Such manipulation leads to delimiter. This vulnerability is documented as CVE-2025-47779. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Asterisk up to 22.4.0. Affected by this issue is an unknown function of the component SIP Request Handler. The manipulation with an unknown input leads to a delimiter vulnerability. Using CWE to declare the problem leads to CWE-140. The product does not neutralize or incorrectly neutralizes delimiters. Impacted is integrity. CVE summarizes:

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-47779 since 05/09/2025. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 237665 (Debian dla-4206 : asterisk - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 18.9-cert14, 18.26.2, 20.7-cert5, 20.14.1, 21.9.1 or 22.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (237665). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Communications System

Name

• Asterisk

Version

• 18.9-cert13
• 18.26.0
• 18.26.1
• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.7-cert4
• 20.8
• 20.9
• 20.10
• 20.11
• 20.12
• 20.13
• 20.14.0
• 21.0
• 21.1
• 21.2
• 21.3
• 21.4
• 21.5
• 21.6
• 21.7
• 21.8
• 21.9.0
• 22.0
• 22.1
• 22.2
• 22.3
• 22.4.0

Website

• Product: https://github.com/asterisk/asterisk/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion