« Volver al listado

CVE-2025-69205

Estado: AplazadaMedia (6.3)—

Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the `Dial( )` application due to improper input validation. This allows an attacker to redirect calls on both of the federating instances. If the attack succeeds, the impact is very high. However, the requires that an admin accept the federation requests. As of time of publication, a known patched version of µURU is not available.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Asterisk — AsteriskAIMicro Registration Utility — Micro Registration UtilityAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-69205",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-69205",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-30T15:46:43.628199Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "olell",
          "product": "uURU",
          "versions": [
            {
              "status": "affected",
              "version": "<= 88db9a953f38a3026bcd6816d51c7f3b93c55893"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-12-29T21:15:43.667",
  "references": [
    {
      "url": "https://docs.asterisk.org/Latest_API/API_Documentation/Dialplan_Applications/Dial",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/olell/uURU/security/advisories/GHSA-xvrh-pm3f-79v4",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the `Dial( )` application due to improper input validation. This allows an attacker to redirect calls on both of the federating instances. If the attack succeeds, the impact is very high. However, the requires that an admin accept the federation requests. As of time of publication, a known patched version of µURU is not available."
    },
    {
      "lang": "es",
      "value": "Micro Registration Utility (µURU) es una utilidad de autorregistro telefónico basada en asterisk. En versiones hasta e incluyendo el commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, un atacante puede elaborar un nombre de federación especial y caracteres tratados como especiales por asterisk pueden ser inyectados en la aplicación 'Dial( )' debido a una validación de entrada incorrecta. Esto permite a un atacante redirigir llamadas en ambas instancias de federación. Si el ataque tiene éxito, el impacto es muy alto. Sin embargo, esto requiere que un administrador acepte las solicitudes de federación. En el momento de la publicación, no hay disponible una versión parcheada conocida de µURU."
    }
  ],
  "lastModified": "2026-10-01T16:10:00.257",
  "sourceIdentifier": "security-advisories@github.com"
}