CVE-2025-47780: cli_permissions.conf: deny option does not work for disallowing shell commands
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring clipermissions.conf (e.g. with the config line deny=!) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the clipermissions.conf file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47780?
CVE-2025-47780 is considered a critical vulnerability due to its potential to allow shell commands to be executed via the Asterisk CLI.
How do I fix CVE-2025-47780?
To fix CVE-2025-47780, upgrade to Asterisk versions 18.26.2, 20.14.1, 21.9.1, 22.4.1, or certified-asterisk versions 18.9-cert14, 20.7-cert5 or later.
Which versions of Asterisk are affected by CVE-2025-47780?
Asterisk versions prior to 18.26.2, 20.14.1, 21.9.1, 22.4.1, and certified-asterisk versions before 18.9-cert14 and 20.7-cert5 are affected by CVE-2025-47780.
What types of attacks can exploit CVE-2025-47780?
CVE-2025-47780 can be exploited to execute arbitrary shell commands, which may lead to unauthorized access or control over the Asterisk system.
Is CVE-2025-47780 related to specific configurations in Asterisk?
Yes, CVE-2025-47780 primarily affects systems where command line interface restrictions are not properly enforced in Asterisk.