Asterisk PBX up to 22.5.0 verification.c null pointer dereference

Summaryinfo

A vulnerability was found in Asterisk PBX up to 18.26.2/20.7-cert6/20.15.0/21.10.0/22.5.0. It has been classified as problematic. The affected element is an unknown function of the file Asterisk/res/res_stir_shaken/verification.c. The manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2025-49832. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Asterisk PBX up to 18.26.2/20.7-cert6/20.15.0/21.10.0/22.5.0 and classified as problematic. This issue affects an unknown code block of the file Asterisk/res/res_stir_shaken/verification.c. The manipulation with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is availability. The summary by CVE is:

Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21.00.0, 22.00.0 through 22.5.0, there is a remote DoS and possible RCE condition in `asterisk/res/res_stir_shaken /verification.c` that can be exploited when an attacker can set an arbitrary Identity header, or STIR/SHAKEN is enabled, with verification set in the SIP profile associated with the endpoint to be attacked. This is fixed in versions 18.26.3, 20.7-cert6, 20.15.1, 21.10.1 and 22.5.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-49832 since 06/11/2025. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 18.26.3, 20.7-cert7, 20.15.1, 21.10.1 or 22.5.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-1697). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Debian Linux
• Gentoo Linux
• Open Source Asterisk

Productinfo

Type

• Communications System

Vendor

• Asterisk

Name

• PBX

Version

• 18.26.0
• 18.26.1
• 18.26.2
• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.7-cert6
• 20.8
• 20.9
• 20.10
• 20.11
• 20.12
• 20.13
• 20.14
• 20.15.0
• 21.0
• 21.1
• 21.2
• 21.3
• 21.4
• 21.5
• 21.6
• 21.7
• 21.8
• 21.9
• 21.10.0
• 22.0
• 22.1
• 22.2
• 22.3
• 22.4
• 22.5.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion