CVE-2025-54995

Katalog CVE

CVSS 6.5 · Medium EPSS 0,49%

Kerentanan Uncontrolled Resource Consumption pada sangoma asterisk, sangoma certified asterisk. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.

Rincian

Terbit di NVD

28 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-1286: Improper Validation of Syntactic Correctness of Input

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/asterisk/asterisk/security/advisories/GHSA-557q-795j-wfx2 exploit · advisory vendor
• https://github.com/asterisk/asterisk/commit/0278f5bde14565c6838a6ec39bc21aee0cde56a9 patch
• https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808338d patch
• https://github.com/asterisk/asterisk/pull/1405 issue tracking
• https://github.com/asterisk/asterisk/pull/1406 issue tracking
• https://lists.debian.org/debian-lts-announce/2025/10/msg00006.html