CVE-2026-57202
highAsterisk is an open source private branch exchange and telephony toolkit.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/20.20.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/21.12.3 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/22.10.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/23.4.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 security-advisories@github.com
- https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959 security-advisories@github.com
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1 security-advisories@github.com