Vulnerability Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sangoma | Asterisk | < 18.26.4 |
| Sangoma | Certified Asterisk | < 18.9 |
Related Weaknesses (CWE)
References
- https://github.com/asterisk/asterisk/commit/0278f5bde14565c6838a6ec39bc21aee0cdePatch
- https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808Patch
- https://github.com/asterisk/asterisk/pull/1405Issue Tracking
- https://github.com/asterisk/asterisk/pull/1406Issue Tracking
- https://github.com/asterisk/asterisk/security/advisories/GHSA-557q-795j-wfx2ExploitVendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00006.html
FAQ
What is CVE-2025-54995?
CVE-2025-54995 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination....
How severe is CVE-2025-54995?
CVE-2025-54995 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-54995?
Check the references section above for vendor advisories and patch information. Affected products include: Sangoma Asterisk, Sangoma Certified Asterisk.