CVE-2026-57202
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
66/100
Published: 2026-10-27
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
None
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Software (12)
| Vendor | Product | Version |
|---|---|---|
| asterisk | asterisk | < 20.20.1 |
| asterisk | asterisk | >= 21.0.0-pre1, < 21.12.3 |
| asterisk | asterisk | >= 22.0.0-pre1, < 22.10.1 |
| asterisk | asterisk | >= 23.0.0-pre1, < 23.4.1 |
| asterisk | asterisk | < 20.20.1 |
| asterisk | asterisk | >= 21.0.0-pre1, < 21.12.3 |
| asterisk | asterisk | >= 22.0.0-pre1, < 22.10.1 |
| asterisk | asterisk | >= 23.0.0-pre1, < 23.4.1 |
| asterisk | certified-asterisk | < 20.7-cert11 |
| asterisk | certified-asterisk | >= 22.8-cert1-pre1, < 22.8-cert3 |
| asterisk | certified-asterisk | < 20.7-cert11 |
| asterisk | certified-asterisk | >= 22.8-cert1-pre1, < 22.8-cert3 |