CVE-2025-54995mediumCWE-1286 CWE-400

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.5%

probabilidad de explotación

0.5%top 61% de las CVE

explotación observada

noninguna fuente lo reporta

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Productos afectados

asterisk · asterisk

Referencias

https://github.com/asterisk/asterisk/commit/0278f5bde14565c6838a6ec39bc21aee0cde56a9 https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808338d https://github.com/asterisk/asterisk/pull/1405 https://github.com/asterisk/asterisk/pull/1406 https://github.com/asterisk/asterisk/security/advisories/GHSA-557q-795j-wfx2 https://lists.debian.org/debian-lts-announce/2025/10/msg00006.html