CVE-2026-57203
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
29/100
Published: 2026-10-27
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
Passive
S:
X
AT:
Present
VC:
High
VI:
High
VA:
None
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs `ast_loggrabber` as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.