Read the docs
TI-2025-34699 Aliases CVE-2025-54995

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

Priority MEDIUM 62CWE-1286Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00509 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed asterisk (asterisk): 18.26.4, 18.9-cert17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 18.26.4; before 18.9-cert1718.26.4, 18.9-cert17Patch availableCNA
  • asterisk Vendorasterisk Affected before 18.26.4; before 18.9-cert17 Fixed in 18.26.4, 18.9-cert17 Patch available CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*before 18.26.4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*before 18.9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*18.9 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*18.9 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*18.9 cert10VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*18.9 cert11VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:*18.9 cert12VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:*18.9 cert13VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert14:*:*:*:*:*:*18.9 cert14VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert15:*:*:*:*:*:*18.9 cert15VulnerableSangoma
  • cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions before 18.26.4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:* Versions before 18.9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:* Versions 18.9 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:* Versions 18.9 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:* Versions 18.9 cert10 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:* Versions 18.9 cert11 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:* Versions 18.9 cert12 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:* Versions 18.9 cert13 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert14:*:*:*:*:*:* Versions 18.9 cert14 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert15:*:*:*:*:*:* Versions 18.9 cert15 Vulnerable ·Sangoma
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert16:*:*:*:*:*:*18.9 cert16VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*18.9 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*18.9 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*18.9 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*18.9 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*18.9 cert6VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*18.9 cert7VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*18.9 cert8VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*18.9 cert8-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*18.9 cert8-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*18.9 cert9VulnerableSangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert16:*:*:*:*:*:* Versions 18.9 cert16 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:* Versions 18.9 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:* Versions 18.9 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:* Versions 18.9 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:* Versions 18.9 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:* Versions 18.9 cert6 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:* Versions 18.9 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:* Versions 18.9 cert8 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:* Versions 18.9 cert8-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:* Versions 18.9 cert8-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:* Versions 18.9 cert9 Vulnerable ·Sangoma

Remediation

  • Fix · CNA asterisk (asterisk) Fixed in 18.26.4, 18.9-cert17

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54995

References

Exploit 1

Patch 2

Other 2

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
  • TI-2023-26930 Asterisk Path Traversal vulnerability CVSS 3.1HIGH 7.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences