CVE-2025-54995mediumCWE-1286 CWE-400

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.5%

probabilidade de exploração

0.5%top 61% das CVEs

exploração observada

nãonenhuma fonte reporta

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Produtos afetados

asterisk · asterisk

Referências

https://github.com/asterisk/asterisk/commit/0278f5bde14565c6838a6ec39bc21aee0cde56a9 https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808338d https://github.com/asterisk/asterisk/pull/1405 https://github.com/asterisk/asterisk/pull/1406 https://github.com/asterisk/asterisk/security/advisories/GHSA-557q-795j-wfx2 https://lists.debian.org/debian-lts-announce/2025/10/msg00006.html