Using malformed From header can forge identity with ";" or NULL in name portion
Priority HIGH 73CWE-140Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00532 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed asterisk (asterisk): 18.9-cert14, 18.26.2, 20.7-cert5 +3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| asterisk | asterisk | before 18.9-cert14; 18.10 to before 18.26.2; 20.0 to before 20.7-cert5; 20.8 to before 20.14.1; 21.0 to before 21.9.1; 22.0 to before 22.4.1 | 18.9-cert14, 18.26.2, 20.7-cert5, 20.14.1, 21.9.1, 22.4.1 | Patch available | CNA |
- asterisk Vendorasterisk Affected before 18.9-cert14; 18.10 to before 18.26.2; 20.0 to before 20.7-cert5; 20.8 to before 20.14.1; 21.0 to before 21.9.1; 22.0 to before 22.4.1 Fixed in 18.9-cert14, 18.26.2, 20.7-cert5, 20.14.1, 21.9.1, 22.4.1 Patch available CNA
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* | before 18.26.2; 20.0.0 to before 20.14.1; 21.0.0 to before 21.9.1; 22.0.0 to before 22.4.1 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:* | before 18.9 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:* | 18.9 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:* | 18.9 cert1 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:* | 18.9 cert1-rc1 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:* | 18.9 cert10 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:* | 18.9 cert11 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:* | 18.9 cert12 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:* | 18.9 cert13 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:* | 18.9 cert2 | Vulnerable | Sangoma |
- cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions before 18.26.2; 20.0.0 to before 20.14.1; 21.0.0 to before 21.9.1; 22.0.0 to before 22.4.1 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:* Versions before 18.9 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:* Versions 18.9 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:* Versions 18.9 cert1 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:* Versions 18.9 cert1-rc1 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:* Versions 18.9 cert10 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:* Versions 18.9 cert11 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:* Versions 18.9 cert12 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:* Versions 18.9 cert13 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:* Versions 18.9 cert2 Vulnerable ·Sangoma
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:* | 18.9 cert3 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:* | 18.9 cert4 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:* | 18.9 cert5 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:* | 18.9 cert6 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:* | 18.9 cert7 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:* | 18.9 cert8 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:* | 18.9 cert8-rc1 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:* | 18.9 cert8-rc2 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:* | 18.9 cert9 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:* | 20.7 cert1 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:* | 20.7 cert1-rc1 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:* | 20.7 cert1-rc2 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:* | 20.7 cert2 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:* | 20.7 cert3 | Vulnerable | Sangoma |
| cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:* | 20.7 cert4 | Vulnerable | Sangoma |
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:* Versions 18.9 cert3 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:* Versions 18.9 cert4 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:* Versions 18.9 cert5 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:* Versions 18.9 cert6 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:* Versions 18.9 cert7 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:* Versions 18.9 cert8 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:* Versions 18.9 cert8-rc1 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:* Versions 18.9 cert8-rc2 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:* Versions 18.9 cert9 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:* Versions 20.7 cert1 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:* Versions 20.7 cert1-rc1 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:* Versions 20.7 cert1-rc2 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:* Versions 20.7 cert2 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:* Versions 20.7 cert3 Vulnerable ·Sangoma
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:* Versions 20.7 cert4 Vulnerable ·Sangoma
Remediation
- Fix · CNA asterisk (asterisk) Fixed in 18.9-cert14, 18.26.2, 20.7-cert5, 20.14.1, 21.9.1, 22.4.1
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47779
References
More asterisk vulnerabilities
- TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
- TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
- TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
- TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
- TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
- TI-2023-26930 Asterisk Path Traversal vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2025-47779 · CVE Program
- CVE-2025-47779 · NVD
- FIRST EPSS
- CVE-2025-47779 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences