Vulnerability · Published Dec 29, 2025 · Assigned by GitHub_M

CVE-2025-69205In µURU, a Specially Crafted Federation Name Allows Dialplan Injection

Medium 6.3

In plain English

A medium-severity improper input validation in uURU from olell. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the `Dial( )` application due to improper input validation. This allows an attacker to redirect calls on both of the federating instances. If the attack succeeds, the impact is very high. However, the requires that an admin accept the federation requests. As of time of publication, a known patched version of µURU is not available.

Affected products (as reported)

Vendor	Product	Versions
olell	uURU	<= 88db9a953f38a3026bcd6816d51c7f3b93c55893

Weakness: CWE-20, CWE-74 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/olell/uURU/security/advisories/GHSA-xvrh-pm3f-79v4 x_refsource_CONFIRM
https://docs.asterisk.org/Latest_API/API_Documentation/Dialplan_Applications/Dial x_refsource_MISC