CVE-2025-47780: Sangoma Asterisk RCE Vulnerability

CVE-2025-47780 Overview

CVE-2025-47780 is a permission bypass vulnerability in Asterisk, an open-source private branch exchange (PBX) system maintained by Sangoma. The flaw resides in the enforcement of cli_permissions.conf, which administrators use to restrict shell command execution through the Asterisk command line interface (CLI). Configuring the file with directives such as deny=!* fails to block shell command invocation as expected. Administrators who rely on this configuration to deny CLI shell access retain a false sense of protection while the underlying commands remain executable. The issue is fixed in Asterisk versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1, and in certified-asterisk versions 18.9-cert14 and 20.7-cert5.

Critical Impact
Authenticated local users with CLI access can execute shell commands despite explicit deny rules in cli_permissions.conf, undermining administrative access controls on Asterisk PBX servers.

Affected Products

Sangoma Asterisk prior to 18.26.2, 20.14.1, 21.9.1, and 22.4.1
Sangoma certified-asterisk 18.9 releases prior to cert14
Sangoma certified-asterisk 20.7 releases prior to cert5

Discovery Timeline

2025-05-22 - CVE-2025-47780 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47780

Vulnerability Analysis

Asterisk exposes an administrative CLI that supports invoking shell commands from the operator console. To restrict this behavior, administrators configure cli_permissions.conf with allow and deny rules per user or command. The vulnerability arises because the permission enforcement path does not correctly evaluate rules intended to block shell command execution. A configuration such as deny=!*, which should reject all commands, is bypassed at runtime.

The weakness maps to CWE-78, Improper Neutralization of Special Elements used in an OS Command. In this case the failure is not in argument sanitization but in the authorization layer that determines whether an OS command may be dispatched at all.

Root Cause

The root cause is faulty permission-check logic applied to CLI shell command invocations. The parser or matcher responsible for interpreting entries in cli_permissions.conf fails to apply deny rules to shell command execution paths. As a result, restrictions defined by administrators are silently ignored, and the CLI defaults to permitting command execution for authenticated CLI users.

Attack Vector

Exploitation requires local access to the Asterisk CLI with valid low-privilege credentials. An attacker who reaches the CLI over its local socket or through a management channel can execute arbitrary shell commands in the context of the Asterisk process user, even when the deployment relies on cli_permissions.conf to forbid such actions. This enables further reconnaissance, credential access, or lateral movement from a PBX host that was assumed to be hardened.

No public proof-of-concept exploit is listed for this CVE, and it is not present on the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the Asterisk GitHub Security Advisory GHSA-c7p6-7mvq-8jq2 and the Debian LTS Announcement.

Detection Methods for CVE-2025-47780

Indicators of Compromise

Unexpected child processes spawned by the asterisk daemon, particularly sh, bash, or common utilities such as curl, wget, nc, or python.
Entries in Asterisk full or messages logs showing ! shell escape usage or exec CLI commands issued by accounts that should be restricted.
Modifications to cli_permissions.conf or Asterisk manager configurations outside of change windows.
New or unusual sessions on the Asterisk CLI Unix socket (typically /var/run/asterisk/asterisk.ctl).

Detection Strategies

Correlate process ancestry so that any non-telephony child process of the Asterisk daemon triggers investigation.
Compare running Asterisk versions against the fixed releases 18.26.2, 20.14.1, 21.9.1, 22.4.1, 18.9-cert14, and 20.7-cert5 during vulnerability scans.
Audit CLI session logs for use of the shell escape prefix or ! operator by accounts scoped only for call control.

Monitoring Recommendations

Forward Asterisk logs and Linux auditd records for the PBX host to a centralized logging platform for long-term retention and analysis.
Monitor read and write access to cli_permissions.conf and alert on out-of-band changes.
Track authentication events against the Asterisk Manager Interface (AMI) and remote CLI channels for anomalous sources or off-hours activity.

How to Mitigate CVE-2025-47780

Immediate Actions Required

Upgrade Asterisk to 18.26.2, 20.14.1, 21.9.1, or 22.4.1, or upgrade certified-asterisk to 18.9-cert14 or 20.7-cert5.
Inventory all PBX hosts and confirm the running Asterisk build with asterisk -V before and after patching.
Review cli_permissions.conf and remove or rotate any CLI credentials that were considered restricted based on the ineffective deny rules.

Patch Information

Sangoma has released fixed builds through the Asterisk project. Refer to the GitHub Security Advisory GHSA-c7p6-7mvq-8jq2 for upstream releases and to the Debian LTS Announcement for distribution-provided packages.

Workarounds

Restrict access to the Asterisk control socket to trusted operators only using filesystem permissions on /var/run/asterisk/asterisk.ctl.
Run the Asterisk daemon under a dedicated non-root service account with minimal shell utilities available on PATH.
Disable or firewall remote management interfaces such as AMI where not required, and require strong authentication where they are.
Apply mandatory access control policies (SELinux or AppArmor) to constrain child processes the Asterisk daemon is permitted to execute.

bash

# Configuration example: verify the running Asterisk version and restrict CLI socket access
asterisk -V
chown root:asterisk /var/run/asterisk/asterisk.ctl
chmod 660 /var/run/asterisk/asterisk.ctl