Dashboard / CVE-2026-57200

CVE-2026-57200

HIGH
MEDIUM Priority: 0.07 BB Relevance: 55/100
Published: 2026-10-27 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

Weakness Classification (2)

References & Advisories (13)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.88%
Raw Score 0.008790
Percentile 59.0%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00879
2026-10-28
0.00879

Intelligence Sources

mitre ref →
nvd ref →

External Links