← Back to CVE Explorer

CVE-2025-1131

Full vulnerability record from the local CVENow database.

Description

A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.

Severity
HIGH
CVSS score
7.0 (v4.0)
Vulnerability status
Modified
Source identifier
b7efe717-a805-47cf-8e9a-921fca0ce0ce
Published
2025-09-23 05:15:35.603000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON 
{
  "id": "CVE-2025-1131",
  "sourceIdentifier": "b7efe717-a805-47cf-8e9a-921fca0ce0ce",
  "published": "2025-09-23T05:15:35.603",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions.\n\n\nNon-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de escalada de privilegios local existe en el script safe_asterisk incluido con el paquete de herramientas de Asterisk. Cuando Asterisk se inicia a través de este script (común en entornos SysV init o FreePBX), carga todos los archivos .sh ubicados en /etc/asterisk/startup.d/ como root, sin validar la propiedad o los permisos.\n\nUsuarios no-root con acceso de escritura legítimo a /etc/asterisk pueden explotar este comportamiento colocando scripts maliciosos en el directorio startup.d, los cuales se ejecutarán entonces con privilegios de root al reiniciar el servicio."
    }
  ],
  "affected": [
    {
      "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce",
      "affectedData": [
        {
          "vendor": "Asterisk",
          "product": "Asterisk",
          "defaultStatus": "unaffected",
          "modules": [
            "safe_asterisk /etc/asterisk/startup.d"
          ],
          "platforms": [
            "Linux",
            "MacOS"
          ],
          "programFiles": [
            "safe_asterisk"
          ],
          "repo": "https://github.com/asterisk/asterisk",
          "versions": [
            {
              "version": "Asterisk <=18.26.2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "Asterisk <= 20.15.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "Asterisk <= 21.10.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "Asterisk <= 22.5.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:C/RE:H/U:Amber",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "CONCENTRATED",
          "vulnerabilityResponseEffort": "HIGH",
          "providerUrgency": "AMBER"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-24T03:55:15.207908Z",
          "id": "CVE-2025-1131",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "18.26.3",
              "matchCriteriaId": "A99F7956-1812-47C7-9649-C889E5A296EB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "20.0.0",
              "versionEndExcluding": "20.15.1",
              "matchCriteriaId": "A3AD4D76-AF85-414E-8C6D-6C505D8D58D3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "21.0.0",
              "versionEndExcluding": "21.10.1",
              "matchCriteriaId": "D23AFE39-A2E8-45EE-9F0B-3A96731299FD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "22.0.0",
              "versionEndExcluding": "22.5.1",
              "matchCriteriaId": "FFA121CE-5F37-4731-A1FA-B83F7E1AD845"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*",
              "matchCriteriaId": "79EEB5E5-B79E-454B-8DCD-3272BA337A9E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*",
              "matchCriteriaId": "AD3BBA39-95EC-462F-8F5A-15E8D07CC804"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*",
              "matchCriteriaId": "D6BF553C-020D-4F99-9995-CA4A4383B2DD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*",
              "matchCriteriaId": "E3069F1F-DDE8-4E9A-B4FF-64B7B11EEFCB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:*",
              "matchCriteriaId": "890205E3-973D-422E-940A-E9190BA37EFD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:*",
              "matchCriteriaId": "23100176-0528-448D-B2FA-D3B9B31A249D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert14:*:*:*:*:*:*",
              "matchCriteriaId": "346B29FD-48B4-4121-89FD-45325865E54B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert15:*:*:*:*:*:*",
              "matchCriteriaId": "49798C73-CCC4-4013-8A01-348D6B3D9C5B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*",
              "matchCriteriaId": "892BAE5D-A64E-4FE0-9A99-8C07F342A042"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*",
              "matchCriteriaId": "1A716A45-7075-4CA6-9EF5-2DD088248A5C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*",
              "matchCriteriaId": "80EFA05B-E22D-49CE-BDD6-5C7123F1C12B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*",
              "matchCriteriaId": "20FD475F-2B46-47C9-B535-1561E29CB7A1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*",
              "matchCriteriaId": "7238FCD9-9F40-44BA-A170-69D4857AA1CE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*",
              "matchCriteriaId": "F657B046-6C83-48F9-A0B1-C63CDA7FD61D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*",
              "matchCriteriaId": "6D87C7DE-23EA-4532-A2E4-9BF82ADE12DC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B79A5B46-5CA3-445E-BE47-1711DCD038A1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*",
              "matchCriteriaId": "D600B37E-94EA-48DE-B48E-871B3A983721"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*",
              "matchCriteriaId": "2FC3A00E-D1C6-467F-8FE7-E8437A527B3C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*",
              "matchCriteriaId": "79225576-AF7C-4099-9624-C53578A7417F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*",
              "matchCriteriaId": "29323E6E-12C9-46C7-B29C-25E0CD537A8E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*",
              "matchCriteriaId": "8E563972-78C0-40A0-83EA-6A3BA3D71946"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*",
              "matchCriteriaId": "64209621-D458-432A-B0E3-C8D0B6698574"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*",
              "matchCriteriaId": "B148158A-8354-41C2-A44C-2C0DAABAD217"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*",
              "matchCriteriaId": "3D4D96E8-1F01-42B8-9181-67DEB12D9DD2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*",
              "matchCriteriaId": "50D1B02A-F5F9-48EB-A396-412821F5D602"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*",
              "matchCriteriaId": "4CBB2891-448F-4C4E-8A47-2283A8F71FE6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp",
      "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00006.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}