Kamailio CVE-2025-12207

Exploitation requires: (1) LOCAL system access (AV:L per CVSS) - attacker must have shell or file system access to the Kamailio host, not remote network access. (2) Authenticated local user privilege (PR:L per CVSS) - attacker must be an authenticated OS-level user on the system, not unauthenticated. (3) Ability to modify or create Kamailio configuration files - typically in /etc/kamailio/ or equivalent directory, which requires file system write permission. (4) Ability to trigger config reload - via systemctl restart, kill -HUP signal, or API reload command, which also requires appropriate privileges. Exploitation does NOT occur during normal runtime or remote SIP request handling; it only occurs during config file parsing at startup or manual reload. This means: passive observation of normal traffic will not trigger the bug; active file system manipulation is mandatory. Default Kamailio installations in production restrict these capabilities to root/privileged users only, making this an insider-threat or post-compromise risk rather than a direct attack vector.

Multiple signals indicate this is LOW REAL-WORLD RISK despite public POC availability. CVSS 4.0/1.9 score reflects low impact (availability only, no confidentiality or integrity), and EPSS 0.03% (8th percentile) strongly indicates this will not be broadly exploited. The CVSS vector confirms: local-only access (AV:L), low complexity (AC:L), authenticated requirement (PR:L), and negligible impact (VA:L only; VC:N, VI:N, SA:N). Critically, description states 'actual existence of this vulnerability is currently in question' and vendor never responded to early disclosure, suggesting possible false positive or research artifact. Attack requires manipulating config files on the local system, which is not a realistic attack vector in production environments where file integrity is typically protected and config changes go through change management processes. POC availability does not elevate risk here because exploitation is fundamentally constrained by local-only access and auth requirement. This is a low-priority denial-of-service in a non-Internet-facing component, likely impacting only lab/development setups or insider threat scenarios.

A system administrator with legitimate local access (e.g., via SSH) or an attacker who has compromised a low-privilege local account on the Kamailio host crafts a malformed configuration file with syntax errors that trigger the yyerror_at function's null pointer dereference. The attacker places the malicious config in Kamailio's configuration directory and triggers a config reload (via signal or service restart), causing the parser to crash during error handling, resulting in service unavailability. Publicly available POC demonstrates the specific syntax pattern needed to trigger the crash.