Search for vulnerabilities
Vulnerability details: VCID-cug9-jj63-ffc1
Vulnerability ID VCID-cug9-jj63-ffc1
Aliases CVE-2025-47779
Summary Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.
Status Published
Exploitability 0.5
Weighted Severity 6.9
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-140 Improper Neutralization of Delimiters
CWE-792 Incomplete Filtering of One or More Instances of Special Elements
System Score Found at
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2025-47779
cvssv3.1 7.7 https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample
ssvc Track https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample
cvssv3.1 7.7 https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw
ssvc Track https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-47779.json
https://api.first.org/data/v1/epss?cve=CVE-2025-47779
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47779
1106528 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1106528
2368030 https://bugzilla.redhat.com/show_bug.cgi?id=2368030
CVE-2025-47779 https://nvd.nist.gov/vuln/detail/CVE-2025-47779
GHSA-2grh-7mhv-fcfw https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw
pjsip.conf.sample https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-22T17:25:58Z/ Found at https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-22T17:25:58Z/ Found at https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw
Exploit Prediction Scoring System (EPSS)
Percentile 0.08986
EPSS Score 0.00035
Published At May 23, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-05-22T20:16:22.653446+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/47xxx/CVE-2025-47779.json 36.0.0