7.8

CVE-2025-1131

Exploit

A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions.


Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Sangoma ≫ Asterisk Version < 18.26.3
Sangoma ≫ Asterisk Version >= 20.0.0 < 20.15.1
Sangoma ≫ Asterisk Version >= 21.0.0 < 21.10.1
Sangoma ≫ Asterisk Version >= 22.0.0 < 22.5.1
Sangoma ≫ Certified Asterisk Version18.9 Updatecert1
Sangoma ≫ Certified Asterisk Version18.9 Updatecert1-rc1
Sangoma ≫ Certified Asterisk Version18.9 Updatecert10
Sangoma ≫ Certified Asterisk Version18.9 Updatecert11
Sangoma ≫ Certified Asterisk Version18.9 Updatecert12
Sangoma ≫ Certified Asterisk Version18.9 Updatecert13
Sangoma ≫ Certified Asterisk Version18.9 Updatecert14
Sangoma ≫ Certified Asterisk Version18.9 Updatecert15
Sangoma ≫ Certified Asterisk Version18.9 Updatecert2
Sangoma ≫ Certified Asterisk Version18.9 Updatecert3
Sangoma ≫ Certified Asterisk Version18.9 Updatecert4
Sangoma ≫ Certified Asterisk Version18.9 Updatecert5
Sangoma ≫ Certified Asterisk Version18.9 Updatecert6
Sangoma ≫ Certified Asterisk Version18.9 Updatecert7
Sangoma ≫ Certified Asterisk Version18.9 Updatecert8
Sangoma ≫ Certified Asterisk Version18.9 Updatecert8-rc1
Sangoma ≫ Certified Asterisk Version18.9 Updatecert8-rc2
Sangoma ≫ Certified Asterisk Version18.9 Updatecert9
Sangoma ≫ Certified Asterisk Version20.7 Updatecert1
Sangoma ≫ Certified Asterisk Version20.7 Updatecert1-rc1
Sangoma ≫ Certified Asterisk Version20.7 Updatecert1-rc2
Sangoma ≫ Certified Asterisk Version20.7 Updatecert2
Sangoma ≫ Certified Asterisk Version20.7 Updatecert3
Sangoma ≫ Certified Asterisk Version20.7 Updatecert4
Sangoma ≫ Certified Asterisk Version20.7 Updatecert5
Sangoma ≫ Certified Asterisk Version20.7 Updatecert6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.132
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
b7efe717-a805-47cf-8e9a-921fca0ce0ce 7 0 0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:C/RE:H/U:Amber
CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.