CVE-2025-47780
- Source
- https://cve.org/CVERecord?id=CVE-2025-47780
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47780.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-47780
- Aliases
-
- GHSA-c7p6-7mvq-8jq2
- Downstream
- Published
- 2025-05-22T16:56:28.937Z
- Modified
- 2026-07-15T02:15:19.800990577Z
- Severity
-
- 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- cli_permissions.conf: deny option does not work for disallowing shell commands
- Details
-
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring
cli_permissions.conf(e.g. with the config linedeny=!*) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on thecli_permissions.conffile to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue. - Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47780.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-78" ] }- References
Affected packages
Git / github.com/asterisk/asterisk
Affected ranges
- Type
- GIT
- Repo
- https://github.com/asterisk/asterisk
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*", "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "18.26.2" }, { "fixed": "18.9" }, { "introduced": "20.0.0" }, { "fixed": "20.14.1" }, { "introduced": "21.0.0" }, { "fixed": "21.9.1" }, { "introduced": "22.0.0" }, { "fixed": "22.4.1" }, { "introduced": "18.9-NA" }, { "last_affected": "18.9-NA" }, { "introduced": "18.9-cert1" }, { "last_affected": "18.9-cert1" }, { "introduced": "18.9-cert1\\-rc1" }, { "last_affected": "18.9-cert1\\-rc1" }, { "introduced": "18.9-cert10" }, { "last_affected": "18.9-cert10" }, { "introduced": "18.9-cert11" }, { "last_affected": "18.9-cert11" }, { "introduced": "18.9-cert12" }, { "last_affected": "18.9-cert12" }, { "introduced": "18.9-cert13" }, { "last_affected": "18.9-cert13" }, { "introduced": "18.9-cert2" }, { "last_affected": "18.9-cert2" }, { "introduced": "18.9-cert3" }, { "last_affected": "18.9-cert3" }, { "introduced": "18.9-cert4" }, { "last_affected": "18.9-cert4" }, { "introduced": "18.9-cert5" }, { "last_affected": "18.9-cert5" }, { "introduced": "18.9-cert6" }, { "last_affected": "18.9-cert6" }, { "introduced": "18.9-cert7" }, { "last_affected": "18.9-cert7" }, { "introduced": "18.9-cert8" }, { "last_affected": "18.9-cert8" }, { "introduced": "18.9-cert8\\-rc1" }, { "last_affected": "18.9-cert8\\-rc1" }, { "introduced": "18.9-cert8\\-rc2" }, { "last_affected": "18.9-cert8\\-rc2" }, { "introduced": "18.9-cert9" }, { "last_affected": "18.9-cert9" }, { "introduced": "20.7-cert1" }, { "last_affected": "20.7-cert1" }, { "introduced": "20.7-cert1\\-rc1" }, { "last_affected": "20.7-cert1\\-rc1" }, { "introduced": "20.7-cert1\\-rc2" }, { "last_affected": "20.7-cert1\\-rc2" }, { "introduced": "20.7-cert2" }, { "last_affected": "20.7-cert2" }, { "introduced": "20.7-cert3" }, { "last_affected": "20.7-cert3" }, { "introduced": "20.7-cert4" }, { "last_affected": "20.7-cert4" } ] }
Affected versions
18.*
18.17.0
18.17.0-rc1
18.17.1
18.18.0
18.18.0-rc1
18.18.1
18.19.0
18.19.0-rc1
18.19.0-rc2
18.20.0
18.20.0-rc1
18.20.1
18.20.2
18.21.0
18.21.0-rc1
18.21.0-rc2
18.22.0
18.22.0-rc1
18.22.0-rc2
18.23.0
18.23.0-rc1
18.23.1
18.24.0
18.24.0-rc1
18.24.1
18.24.2
18.24.3
18.25.0
18.25.0-rc1
18.25.0-rc2
18.26.0
18.26.0-rc1
18.26.1
18.9-NA
18.9-cert1
18.9-cert10
18.9-cert11
18.9-cert12
18.9-cert13
18.9-cert1\-rc1
18.9-cert2
18.9-cert3
18.9-cert4
18.9-cert5
18.9-cert6
18.9-cert7
18.9-cert8
18.9-cert8\-rc1
18.9-cert8\-rc2
18.9-cert9
18.9.0-rc1
20.*
20.10.0
20.10.0-rc1
20.10.0-rc2
20.11.0
20.11.0-rc1
20.11.1
20.12.0
20.12.0-rc1
20.12.0-rc2
20.13.0
20.13.0-rc1
20.14.0
20.14.0-rc1
20.2.0
20.2.0-rc1
20.2.1
20.3.0
20.3.0-rc1
20.3.1
20.4.0
20.4.0-rc1
20.4.0-rc2
20.5.0
20.5.0-rc1
20.5.1
20.5.2
20.6.0
20.6.0-rc1
20.6.0-rc2
20.7-cert1
20.7-cert1\-rc1
20.7-cert1\-rc2
20.7-cert2
20.7-cert3
20.7-cert4
20.7.0
20.7.0-rc1
20.7.0-rc2
20.8.0
20.8.0-rc1
20.8.1
20.9.0
20.9.0-rc1
20.9.1
20.9.2
20.9.3
21.*
21.0.0
21.0.1
21.0.2
21.1.0
21.1.0-rc1
21.1.0-rc2
21.2.0
21.2.0-rc1
21.2.0-rc2
21.3.0
21.3.0-rc1
21.3.1
21.4.0
21.4.0-rc1
21.4.1
21.4.2
21.4.3
21.5.0
21.5.0-rc1
21.5.0-rc2
21.6.0
21.6.0-rc1
21.6.1
21.7.0
21.7.0-rc1
21.7.0-rc2
21.8.0
21.8.0-rc1
21.9.0
21.9.0-rc1
22.*
22.0.0
22.1.0
22.1.0-rc1
22.1.1
22.2.0
22.2.0-rc1
22.2.0-rc2
22.3.0
22.3.0-rc1
22.4.0
22.4.0-rc1
certified-20.*
certified-20.7-cert1
certified-20.7-cert1-pre1
certified-20.7-cert1-rc1
certified-20.7-cert1-rc2
certified-20.7-cert2
certified-20.7-cert3
certified-20.7-cert4