EUVD-2026-111345Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain read-only ARI credentials
-
DeliveryReach enabled Asterisk HTTP/ARI endpoint
-
ExploitCall setChannelVar invoking FILE() write
-
ExecutionBypass live_dangerously safeguard
-
ImpactWrite arbitrary file as Asterisk process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Privilege defined with unsafe actions
|
| Exploitation Conditions | Three concrete preconditions must all hold, per the vendor advisory: (1) the Asterisk HTTP web server must be enabled - it is disabled by default; (2) the attacker must be able to reach that HTTP server - even when enabled it binds only to 127.0.0.1 by default, so remote reach requires a non-default bind address or a proxy/pivot; and (3) the attacker must already possess valid read-only ARI credentials. Given these, the attacker uses the ARI setChannelVar operation to execute write dialplan functions (including FILE() writes) even when live_dangerously in asterisk.conf is set to no. Limiting factors that reduce real-world exposure: default-disabled HTTP, default loopback-only binding, and the hard requirement for pre-existing authenticated (read-only) ARI access. |
| Impact | Signals are moderately consistent and point to a real but access-gated risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring low privileges, which matches the description: the attacker must already hold valid read-only ARI credentials and reach the Asterisk HTTP server. CWE-267 (privilege defined with unsafe actions) and CWE-1220 from the advisory align with the core defect - a read-only role executing write dialplan functions and bypassing the live_dangerously=no safeguard. The vuln.today decision label is this_week, indicating prioritized but not emergency remediation. No KEV listing and no EPSS score are provided, and no PoC or working-exploit reference is present (the referenced GitHub links are the vendor advisory, fix commits, and release tags), so active exploitation is not confirmed. The key tension is between the network attack vector and strong real-world constraints: the HTTP server is disabled by default and, when enabled, binds only to 127.0.0.1 by default, and valid read-only ARI credentials are a hard prerequisite. This is therefore a genuine privilege/safeguard-bypass issue worth patching promptly for anyone exposing ARI, rather than a mass-exploitable internet-wide threat; with EPSS and KEV absent, widespread automated exploitation cannot be inferred from the inputs. |
| Exploit ScenarioDerived | An attacker who already holds read-only ARI credentials (for example a limited integration account or a leaked monitoring token) connects to a reachable Asterisk HTTP/ARI endpoint and issues a setChannelVar call whose value invokes a write dialplan function such as FILE(), bypassing the live_dangerously=no protection. This lets a read-only principal write arbitrary files as the Asterisk process, enabling configuration tampering or escalation toward broader compromise. No public exploit was identified at time of analysis; only the vendor advisory and fix commits are referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Asterisk's REST Interface (ARI) allows a caller holding only read-only credentials to invoke write-capable dialplan functions - most notably FILE() - through the setChannelVar operation, even when live_dangerously is set to no in asterisk.conf, so a supposedly low-privilege ARI user can write files on the PBX host. Affected releases are Asterisk 20.x through 20.20.0, 21.x through 21.12.2, 22.x through 22.10.0, 23.x through 23.4.0, plus Certified Asterisk 20.7-cert10 and 22.8-cert2 and earlier; exposure requires the Asterisk HTTP server to be enabled and reachable and the attacker to already hold valid read-only ARI credentials. No public exploit code was identified at time of analysis, and vendor patches are available in 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified 20.7-cert11 and Certified 22.8-cert3.
RemediationAI
Upgrade to a fixed release for your branch: Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk 20.7-cert11 or 22.8-cert3, as documented in the GHSA advisory at https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959 and the corresponding release tags; the fix is carried in commits 8f8ccaf70a80e518147b0c35c0c252de4735446f and the accompanying backport commits listed in the CVE references. Per the vendor's stated preconditions, exposure only occurs when the Asterisk HTTP server is enabled, reachable beyond its default 127.0.0.1 binding, and usable with valid read-only ARI credentials - so interim compensating controls are to leave the HTTP server disabled where ARI is not in use, keep http.conf bound to 127.0.0.1 (or otherwise restrict reachability with firewall rules or a fronting proxy that enforces authentication), and review/rotate ARI credentials that may have leaked, noting that even read-only accounts are sufficient to trigger this flaw and that setting live_dangerously=no does not mitigate it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Asterisk REST Interface is an HTTP/JSON front end onto the Stasis application framework; ARI clients manipulate live channels through REST calls, and setChannelVar ends up in res/stasis/control.c calling pbx_builtin_setvar_helper(). That helper is the same code path the dialplan uses, so when the supplied variable name matches a registered dialplan function such as FILE(), Asterisk evaluates the function rather than storing a literal string. The live_dangerously option in asterisk.conf exists precisely to stop non-dialplan callers (AMI, ARI and similar) from reaching these executable functions, and the ARI control path failed to enforce it because the calling thread did not set the inhibit_escalations flag before the setvar call. The GHSA classifies the weakness as CWE-267 (privilege defined with unsafe actions) with an additional CWE-1220 tag for insufficient granularity of access control: a read-only ARI principal is granted an action - write dialplan function execution - that it should never reach. The upstream fix wraps the setvar helper in ast_thread_inhibit_escalations_swap(1) and restores the previous inhibit state when the call returns, so function escalation is suppressed regardless of the live_dangerously setting.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Requires valid read-only ARI credentials over HTTP so PR:L/AV:N/AC:L; arbitrary file write via FILE() is primarily high integrity, with limited confidentiality and availability consequences.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when live_dangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Technical POC Analysis
CWE-267 (Privilege Defined With Unsafe Actions), with CWE-1220 (Insufficient Granularity of Access Control) as a secondary classification.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-57202 is a high-severity flaw in Asterisk's REST Interface (ARI) that lets a read-only ARI user write files on the PBX host, undermining the intended low-privilege role. Organizations running affected Asterisk versions with the HTTP server enabled face potential unauthorized file modification, which could lead to service disruption or further compromise, impacting telephony operations and data integrity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB