{"id":85871,"date":"2025-11-18T09:32:39","date_gmt":"2025-11-18T09:32:39","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-47779-spoofing-vulnerability-in-asterisk-s-sip-message-authentication","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-47779-spoofing-vulnerability-in-asterisk-s-sip-message-authentication\/","title":{"rendered":"CVE-2025-47779: Spoofing Vulnerability in Asterisk’s SIP Message Authentication<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report details a significant vulnerability, CVE-2025-47779, found in various versions of Asterisk, an open-source private branch exchange (PBX) system. The vulnerability can potentially allow an authenticated attacker to spoof user identities and send spam messages by exploiting the misalignment in the MESSAGE authentication of Asterisk’s Session Initiation Protocol (SIP). This poses a serious threat to the integrity and confidentiality of communication systems using Asterisk, as it could enable social engineering and phishing attacks.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-47779
\nSeverity: High (7.7 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: None
\nImpact: Compromise of system integrity, potential data leakage, and possibility of spam, phishing, and social engineering attacks.<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Asterisk | Prior to 18.26.2, 20.14.1, 21.9.1, and 22.4.1
\nCertified-asterisk | Prior to 18.9-cert14 and 20.7-cert5<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability lies in the SIP MESSAGE authentication method in Asterisk. Due to improper alignment in the authentication process, an authenticated attacker can manipulate SIP requests of the type MESSAGE to spoof any user identity. By spoofing trusted entities, the attacker can send spam messages to users using their authorization tokens. This can lead to the abuse of user trust, enabling the attacker to launch phishing and social engineering attacks.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a conceptual example of how the vulnerability could be exploited with a SIP MESSAGE request:<\/p>\n

MESSAGE \/vulnerable\/endpoint SIP\/2.0\nVia: SIP\/2.0\/TCP attacker.com\nFrom: \"Spoofed User\" ;tag=1928301774\nTo: \nCall-ID: 50000\nCSeq: 1 MESSAGE\nContent-Type: text\/plain\nAuthorization: Digest username=\"attacker\",realm=\"asterisk\",nonce=\"...\",uri=\"sip:spoofeduser@target.com\",response=\"...\"\nSpam message or phishing link<\/code><\/pre>\n
Mitigation Guidance<\/strong><\/p>\n
Affected systems should apply the vendor-provided patch immediately. The patch is available in the following updated versions of Asterisk and Certified-asterisk: 18.26.2, 20.14.1, 21.9.1, and 22.4.1, and 18.9-cert14 and 20.7-cert5 respectively. As a temporary mitigation, use of a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can help detect and block malicious traffic. However, these are not long-term solutions, as the vulnerability is inherent to the system and needs to be patched.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report details a significant vulnerability, CVE-2025-47779, found in various versions of Asterisk, an open-source private branch exchange (PBX) system. The vulnerability can potentially allow an authenticated attacker to spoof user identities and send spam messages by exploiting the misalignment in the MESSAGE authentication of Asterisk’s Session Initiation Protocol (SIP). This poses a serious […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-85871","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t