Ameeba Security Research

Defensive CVE and exploit intelligence

Ameeba Blog Search
TRENDING · 1 WEEK
Attack Vector
Vendor
Severity

CVE-2025-47779: Spoofing Vulnerability in Asterisk’s SIP Message Authentication

Views: 1,014

Overview

This report details a significant vulnerability, CVE-2025-47779, found in various versions of Asterisk, an open-source private branch exchange (PBX) system. The vulnerability can potentially allow an authenticated attacker to spoof user identities and send spam messages by exploiting the misalignment in the MESSAGE authentication of Asterisk’s Session Initiation Protocol (SIP). This poses a serious threat to the integrity and confidentiality of communication systems using Asterisk, as it could enable social engineering and phishing attacks.

Vulnerability Summary

CVE ID: CVE-2025-47779
Severity: High (7.7 CVSS Score)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Compromise of system integrity, potential data leakage, and possibility of spam, phishing, and social engineering attacks.

Affected Products

Ameeba Chat Icon Share secrets securely

Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.

Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.

  • • Encrypted identity
  • • Private Spaces for organizations and teams
  • • End-to-end encrypted chat, calls, files, and notes
  • • Sensitive AI work and protected collaboration
  • • Built for information that cannot leak

Our mission is to secure human work alongside AI.

Product | Affected Versions

Asterisk | Prior to 18.26.2, 20.14.1, 21.9.1, and 22.4.1
Certified-asterisk | Prior to 18.9-cert14 and 20.7-cert5

How the Exploit Works

The vulnerability lies in the SIP MESSAGE authentication method in Asterisk. Due to improper alignment in the authentication process, an authenticated attacker can manipulate SIP requests of the type MESSAGE to spoof any user identity. By spoofing trusted entities, the attacker can send spam messages to users using their authorization tokens. This can lead to the abuse of user trust, enabling the attacker to launch phishing and social engineering attacks.

Conceptual Example Code

Here is a conceptual example of how the vulnerability could be exploited with a SIP MESSAGE request:

MESSAGE /vulnerable/endpoint SIP/2.0
Via: SIP/2.0/TCP attacker.com
From: "Spoofed User" <sip:spoofeduser@target.com>;tag=1928301774
To: <sip:victim@target.com>
Call-ID: 50000
CSeq: 1 MESSAGE
Content-Type: text/plain
Authorization: Digest username="attacker",realm="asterisk",nonce="...",uri="sip:spoofeduser@target.com",response="..."
Spam message or phishing link

Mitigation Guidance

Affected systems should apply the vendor-provided patch immediately. The patch is available in the following updated versions of Asterisk and Certified-asterisk: 18.26.2, 20.14.1, 21.9.1, and 22.4.1, and 18.9-cert14 and 20.7-cert5 respectively. As a temporary mitigation, use of a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can help detect and block malicious traffic. However, these are not long-term solutions, as the vulnerability is inherent to the system and needs to be patched.

Want to discuss this further? Join the Ameeba Cybersecurity Group Chat.

Disclaimer:

The information and code presented in this article are provided for educational and defensive cybersecurity purposes only. Any conceptual or pseudocode examples are simplified representations intended to raise awareness and promote secure development and system configuration practices.

Do not use this information to attempt unauthorized access or exploit vulnerabilities on systems that you do not own or have explicit permission to test.

Ameeba and its authors do not endorse or condone malicious behavior and are not responsible for misuse of the content. Always follow ethical hacking guidelines, responsible disclosure practices, and local laws.

More posts

Ameeba Chat