CVE-2025-49832 Overview
CVE-2025-49832 is a null pointer dereference vulnerability in Sangoma Asterisk, an open source private branch exchange (PBX) and telephony toolkit. The flaw resides in asterisk/res/res_stir_shaken/verification.c and can be triggered when an attacker sets an arbitrary Identity header on a Session Initiation Protocol (SIP) request, provided STIR/SHAKEN verification is enabled on the endpoint's SIP profile. Successful exploitation causes a remote denial of service (DoS) and may allow remote code execution (RCE) under certain conditions. The issue is tracked as [CWE-476: NULL Pointer Dereference].
Critical Impact
Remote attackers with low privileges can crash Asterisk telephony services and potentially execute code by manipulating SIP Identity headers processed by STIR/SHAKEN verification.
Affected Products
- Sangoma Asterisk versions up to and including 18.26.2
- Sangoma Asterisk versions 20.0.0 through 20.15.0, 21.0.0, and 22.0.0 through 22.5.0
- Sangoma Certified Asterisk 20.7-cert1 through 20.7-cert6
Discovery Timeline
- 2025-08-01 - CVE-2025-49832 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49832
Vulnerability Analysis
Asterisk implements Secure Telephony Identity Revisited (STIR) and Signature-based Handling of Asserted information using toKENs (SHAKEN) to verify the authenticity of SIP callers. The verification routine parses the Identity header from incoming SIP requests inside res_stir_shaken/verification.c. When the header is present but malformed, absent expected fields, or references data that fails to resolve, the code path dereferences a pointer that was never initialized or was set to NULL.
The dereference terminates the Asterisk process, disrupting all active and pending calls handled by the server. Because the affected memory access occurs on data controlled by the remote peer, the advisory also notes the potential for remote code execution, though public exploitation details are not available.
Root Cause
The root cause is missing validation of pointers returned during STIR/SHAKEN Identity header parsing and passport verification. The affected function proceeds to operate on structures that may be NULL when parsing or certificate retrieval fails, producing an unsafe dereference on attacker-controlled input paths.
Attack Vector
Exploitation requires network reachability to the SIP endpoint and the ability to send a crafted SIP request containing an attacker-supplied Identity header. The vulnerability is reachable when STIR/SHAKEN is enabled with verification configured on the SIP profile associated with the target endpoint. No user interaction is required, and only low-privileged access to submit SIP traffic to the endpoint is needed.
No verified public proof-of-concept code is available. See the Asterisk GitHub Security Advisory GHSA-mrq5-74j5-f5cr for maintainer-provided technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2025-49832
Indicators of Compromise
- Unexpected termination or repeated restarts of the asterisk process on hosts with STIR/SHAKEN verification enabled.
- SIP INVITE or other request messages arriving from untrusted sources containing malformed or unusually structured Identity headers.
- Core dumps or segmentation fault entries in system logs referencing res_stir_shaken or verification.c.
Detection Strategies
- Inspect SIP traffic at the session border controller or firewall for Identity headers that do not conform to RFC 8224 passport structure.
- Correlate Asterisk crash events with inbound SIP request timestamps and source IP addresses to identify probing behavior.
- Enable verbose logging in res_stir_shaken to capture verification failures preceding a crash.
Monitoring Recommendations
- Alert on process crashes and service restarts for the Asterisk daemon using host telemetry or systemd unit failure events.
- Monitor call setup failure rates and dropped registrations as secondary indicators of a DoS condition against the PBX.
- Track outbound network connections initiated by the Asterisk process for anomalies that could indicate post-exploitation activity.
How to Mitigate CVE-2025-49832
Immediate Actions Required
- Upgrade Asterisk to a fixed release: 18.26.3, 20.15.1, 21.10.1, 22.5.1, or Certified Asterisk 20.7-cert6 (fixed build) as documented in the vendor advisory.
- Restrict SIP signaling on affected endpoints to trusted peers using firewall rules or access control lists until patches are applied.
- Audit SIP profiles to identify which endpoints have STIR/SHAKEN verification enabled and prioritize patching those systems.
Patch Information
The Asterisk maintainers released fixes in versions 18.26.3, 20.15.1, 21.10.1, 22.5.1, and Certified Asterisk 20.7-cert6. Refer to the Asterisk GitHub Security Advisory GHSA-mrq5-74j5-f5cr for release notes and upgrade guidance.
Workarounds
- Disable STIR/SHAKEN verification on affected SIP profiles if the feature is not required, removing the vulnerable code path from exposure.
- Deploy a SIP-aware proxy or session border controller in front of Asterisk to strip or validate Identity headers from untrusted sources.
- Enforce IP allow-listing so that only known upstream carriers can deliver SIP requests carrying Identity headers to the PBX.
# Example: disable STIR/SHAKEN verification on a PJSIP endpoint in pjsip.conf
[endpoint-example]
type=endpoint
; stir_shaken=attest ; original setting
stir_shaken=off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
