PT-2025-5774 · Asterisk+1 · Asterisk+1
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Asterisk version 22
Description:
The issue allows a remote attacker to execute arbitrary code via the
action createconfig function. This is due to an insecure permissions vulnerability.Recommendations:
For Asterisk version 22, as a temporary workaround, consider disabling the
action createconfig function until a patch is available. Restrict access to the affected function to minimize the risk of exploitation.Exploit
Fix
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Asterisk
Debian