Critical Asterisk Security Update: Patch CVE-2025-47779 & CVE-2025-47780 Now

 

Urgent Asterisk PBX security update fixes CVE-2025-47779 (SIP spoofing) and CVE-2025-47780 (CLI shell execution). Learn how to patch Debian 11 systems, mitigate risks, and secure enterprise VoIP communications against advanced threats.

Why This Asterisk Update Matters for Enterprise Security

Two critical vulnerabilities (CVE-2025-47779 and CVE-2025-47780) in Asterisk—the world’s leading open-source PBX platform—could expose businesses to social engineering attacks, data breaches, and unauthorized system access. 

This Debian LTS advisory (DLA 4206-1) mandates immediate action for organizations using VoIP or UCaaS solutions.

🔍 Vulnerability Breakdown

1. CVE-2025-47779: SIP MESSAGE Spoofing

• Risk Level: High (CVSS: 8.1)

• Impact: Authenticated attackers can impersonate trusted users via SIP MESSAGE requests, enabling phishing or malware distribution through spoofed chat messages.

• Affected Systems: Asterisk versions prior to 1:16.28.0~dfsg-0+deb11u7 on Debian 11 Bullseye.

• Monetization Keywords: VoIP security, SIP authentication, enterprise communication tools, UCaaS compliance

2. CVE-2025-47780: CLI Shell Command Bypass

• Risk Level: Critical (CVSS: 9.3)

• Impact: Remote attackers can execute arbitrary shell commands despite cli_permissions.conf restrictions, compromising server integrity.

• Fix: New disable_remote_console_shell option in asterisk.conf.

---

How to Patch Your Asterisk PBX

1. For Debian 11 Systems:

   bash

   Copy

   Download

   sudo apt update && sudo apt upgrade asterisk

   Confirm version 1:16.28.0~dfsg-0+deb11u7 post-upgrade.

2. Additional Mitigations:

   • Audit SIP MESSAGE usage via sip.conf.

   • Set disable_remote_console_shell=yes in asterisk.conf.

Pro Tip: Pair this update with a VoIP firewall (e.g., OPNsense, pfSense) to filter malicious SIP traffic.

---

FAQs: Asterisk Security Best Practices

Q: Can these vulnerabilities affect cloud-hosted PBX solutions?

A: Yes—both on-prem and cloud Asterisk deployments are at risk. Providers like FreePBX, 3CX, or AWS Chime SDK users should verify their backend versions.

Q: What’s the business impact of unpatched Asterisk systems?

A: Compliance violations (HIPAA, GDPR), call fraud, and reputational damage. Consider managed PBX services for enterprises lacking in-house expertise.