CVE-2025-54995CWE-1286CWE-400

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

Medium · published August 28, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00489 · 41.1th percentile
Weaknesses
CWE-1286 · Improper Validation of Syntactic Correctness of Input; CWE-400 · Uncontrolled Resource Consumption
Published
2025-08-28T15:08Z
EPSS history
Timeline
  • 28 AUG 15:08Z
    Asterisk remotely exploitable leak of RTP UDP ports and internal resources
    cvelistv5