CVE-2025-1131
Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
- State
- Published
- Severity
- 7.0 High
- Published
- Sep 23, 2025
- Updated
- Feb 26, 2026
- Reserved
- Feb 8, 2025
Description
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions.
Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/V:C/RE:H/U:Amber | Gridware |
Weaknesses
- CWE-427 Uncontrolled Search Path Element
Affected Products
| Product | Versions |
|---|---|
AsteriskAsterisk |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.