µURU CVE-2025-69205

Exploitation requires that the target µURU instance has federation enabled and that an administrator manually accepts a federation request originating from the attacker - this human approval step is the primary limiting factor and means the attack cannot succeed against instances that reject or do not use federation. The attacker must control a federating party able to supply a crafted federation name containing characters special to Asterisk's dialplan/Dial() application. No special authentication on the target is needed by the attacker beyond submitting the request, but the admin-acceptance requirement and the fact that no patch is available (mitigation is limited to vetting federation requests) define the realistic exposure. Affects µURU up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893.

This is a low-to-moderate real-world priority despite a high technical impact, driven primarily by its deployment footprint and preconditions rather than its severity. The official CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:R, base 6.3) is internally inconsistent with the description: the flaw is triggered by an external federating party who crafts a malicious federation name delivered over a network, not by a local, already-highly-privileged user - so AV:L and PR:H appear to understate the vector while the genuine limiter (an admin must manually accept the federation request) is better modeled as UI:R. If re-scored as a network, unauthenticated, admin-interaction-gated injection, the technical severity rises (my independent estimate ~8.0), but the practical risk stays constrained. Exploitation status is 'no public exploit identified at time of analysis' - not in CISA KEV and no POC referenced. EPSS is very low (0.14%, 3rd percentile), consistent with an obscure product and a human-in-the-loop precondition. There is no SSVC decision data provided. Net: high CWE-20/code-injection impact on paper, but the mandatory admin acceptance step, absence of any public exploit, very low EPSS, and tiny deployment base make this a targeted, opportunistic risk rather than a widespread one. Note also: no patched version exists as of publication, so affected operators cannot remediate by upgrading and must mitigate by scrutinizing federation requests.

An attacker operating a federating µURU instance crafts a federation name containing characters that Asterisk treats as special (e.g. dialplan/Dial() control characters) and submits a federation request to a target instance. If a target administrator accepts the federation, the injected characters are passed unsanitized into the Dial() application, letting the attacker redirect calls on both the attacker's and the victim's instances. No public exploit code is referenced, so an attacker would need to develop the injection payload from the advisory details.