VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Aug 1, 2025· Updated Jun 17, 2026

CVE-2025-49832

CVE-2025-49832

Description

Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21.00.0, 22.00.0 through 22.5.0, there is a remote DoS and possible RCE condition in asterisk/res/res_stir_shaken /verification.c that can be exploited when an attacker can set an arbitrary Identity header, or STIR/SHAKEN is enabled, with verification set in the SIP profile associated with the endpoint to be attacked. This is fixed in versions 18.26.3, 20.7-cert6, 20.15.1, 21.10.1 and 22.5.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

12
  • Freepbx/Asterisk
    cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*
    Range: <18.26.3
  • Freepbx/Certified Asterisk9 versions
    cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*+ 8 more
    • cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*range: <=18.9
    • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*
    • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*
    • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*
    • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*
    • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*
    • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*
    • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*
    • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*
  • Asterisk/Asteriskllm-fuzzy2 versions
    <18.26.3, <20.15.1, <21.10.1, <22.5.1+ 1 more
    • (no CPE)range: <18.26.3, <20.15.1, <21.10.1, <22.5.1
    • (no CPE)range: < 18.26.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.