Read the docs
TI-2025-00959 Aliases CVE-2025-1131

Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation

Priority HIGH 66CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-427.

Summary

A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskAsteriskAsterisk <=18.26.2; Asterisk <= 20.15.0; Asterisk <= 21.10.0; Asterisk <= 22.5.0—No fix listedCNA
  • Asterisk Vendorasterisk Affected Asterisk <=18.26.2; Asterisk <= 20.15.0; Asterisk <= 21.10.0; Asterisk <= 22.5.0 Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*before 18.26.3; 20.0.0 to before 20.15.1; 21.0.0 to before 21.10.1; 22.0.0 to before 22.5.1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*18.9 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*18.9 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*18.9 cert10VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*18.9 cert11VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:*18.9 cert12VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:*18.9 cert13VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert14:*:*:*:*:*:*18.9 cert14VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert15:*:*:*:*:*:*18.9 cert15VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*18.9 cert2VulnerableSangoma
  • cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions before 18.26.3; 20.0.0 to before 20.15.1; 21.0.0 to before 21.10.1; 22.0.0 to before 22.5.1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:* Versions 18.9 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:* Versions 18.9 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:* Versions 18.9 cert10 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:* Versions 18.9 cert11 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:* Versions 18.9 cert12 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:* Versions 18.9 cert13 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert14:*:*:*:*:*:* Versions 18.9 cert14 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert15:*:*:*:*:*:* Versions 18.9 cert15 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:* Versions 18.9 cert2 Vulnerable ·Sangoma
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*18.9 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*18.9 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*18.9 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*18.9 cert6VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*18.9 cert7VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*18.9 cert8VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*18.9 cert8-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*18.9 cert8-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*18.9 cert9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*20.7 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*20.7 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*20.7 cert1-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*20.7 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*20.7 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*20.7 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*20.7 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*20.7 cert6VulnerableSangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:* Versions 18.9 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:* Versions 18.9 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:* Versions 18.9 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:* Versions 18.9 cert6 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:* Versions 18.9 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:* Versions 18.9 cert8 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:* Versions 18.9 cert8-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:* Versions 18.9 cert8-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:* Versions 18.9 cert9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:* Versions 20.7 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:* Versions 20.7 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:* Versions 20.7 cert1-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:* Versions 20.7 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:* Versions 20.7 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:* Versions 20.7 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:* Versions 20.7 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:* Versions 20.7 cert6 Vulnerable ·Sangoma

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1131

References

Exploit 1

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
  • TI-2023-26930 Asterisk Path Traversal vulnerability CVSS 3.1HIGH 7.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences