CVEvulnerability

CVE-2025-1131

7.0 HIGH Published 2025-09-23 Modified 2026-10-19 Official page ↗
Status
Modified
Published
2025-09-23
Last modified
2026-10-19
Assigner
b7efe717-a805-47cf-8e9a-921fca0ce0ce
CVSS 4.0 (b7efe717-a805-47cf-8e9a-921fca0ce0ce)
7.0 HIGH — CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:C/RE:H/U:Amber
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-427

Description

A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.

Affected configurations

• sangoma asterisk (< 18.26.3) • sangoma asterisk (>= 20.0.0 < 20.15.1) • sangoma asterisk (>= 21.0.0 < 21.10.1) • sangoma asterisk (>= 22.0.0 < 22.5.1) • sangoma certified asterisk 18.9 • sangoma certified asterisk 20.7

Related

Weakness · CWE (1)

  • CWE-427 Uncontrolled Search Path Element weakness

References