Overview
This report details a significant vulnerability, CVE-2025-47779, found in various versions of Asterisk, an open-source private branch exchange (PBX) system. The vulnerability can potentially allow an authenticated attacker to spoof user identities and send spam messages by exploiting the misalignment in the MESSAGE authentication of Asterisk’s Session Initiation Protocol (SIP). This poses a serious threat to the integrity and confidentiality of communication systems using Asterisk, as it could enable social engineering and phishing attacks.
Vulnerability Summary
CVE ID: CVE-2025-47779
Severity: High (7.7 CVSS Score)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Compromise of system integrity, potential data leakage, and possibility of spam, phishing, and social engineering attacks.
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Asterisk | Prior to 18.26.2, 20.14.1, 21.9.1, and 22.4.1
Certified-asterisk | Prior to 18.9-cert14 and 20.7-cert5
How the Exploit Works
The vulnerability lies in the SIP MESSAGE authentication method in Asterisk. Due to improper alignment in the authentication process, an authenticated attacker can manipulate SIP requests of the type MESSAGE to spoof any user identity. By spoofing trusted entities, the attacker can send spam messages to users using their authorization tokens. This can lead to the abuse of user trust, enabling the attacker to launch phishing and social engineering attacks.
Conceptual Example Code
Here is a conceptual example of how the vulnerability could be exploited with a SIP MESSAGE request:
MESSAGE /vulnerable/endpoint SIP/2.0
Via: SIP/2.0/TCP attacker.com
From: "Spoofed User" <sip:spoofeduser@target.com>;tag=1928301774
To: <sip:victim@target.com>
Call-ID: 50000
CSeq: 1 MESSAGE
Content-Type: text/plain
Authorization: Digest username="attacker",realm="asterisk",nonce="...",uri="sip:spoofeduser@target.com",response="..."
Spam message or phishing linkMitigation Guidance
Affected systems should apply the vendor-provided patch immediately. The patch is available in the following updated versions of Asterisk and Certified-asterisk: 18.26.2, 20.14.1, 21.9.1, and 22.4.1, and 18.9-cert14 and 20.7-cert5 respectively. As a temporary mitigation, use of a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can help detect and block malicious traffic. However, these are not long-term solutions, as the vulnerability is inherent to the system and needs to be patched.
