EUVD-2026-111402Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authorized shell on Asterisk server
-
DeliveryPlant malicious .ast_tsconvert.py in /tmp
-
ExploitAdministrator runs ast_loggrabber as privileged user
-
ExecutionPlanted Python executes with elevated privileges
-
ImpactAttacker gains elevated code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
| Exploitation Conditions | Two concrete preconditions must both hold: (1) the attacker must already have an authorized interactive shell account on the Asterisk server to write to the world-writable /tmp directory, and (2) an administrator must subsequently run the contrib/scripts/ast_loggrabber diagnostic script as a user with elevated privileges - the vulnerable version executes a Python helper from the fixed path /tmp/.ast_tsconvert.py, which the attacker can control. Limiting factors that reduce real-world risk: exploitation is local only (no remote/network vector), the attacker needs existing authenticated shell access, and it depends on a privileged user actually invoking ast_loggrabber (a manual log-collection action, not a routine service), so it affects only deployments where untrusted users have shell access and the diagnostic tool is run with elevated privileges. |
| Impact | This is a genuine but constrained local privilege-escalation / code-execution issue (CWE-426, untrusted search path), not a widespread remote threat. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P, score 6.9 Medium) tells the story: exploitation is local only, requires the attacker to already hold an authorized shell account (PR:L), depends on an attack requirement being met (AT:P - an administrator must actually run ast_loggrabber), and needs that privileged user's passive interaction (UI:P). Impact is high on both confidentiality and integrity, including a cross-privilege effect (VC:H/VI:H, SC:H/SI:H), but no availability impact (VA:N/SA:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis - the only exploitation-relevant artifacts are vendor patch commits, which are fixes, not PoC exploit code. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency priority: the combination of required prior shell access and a privileged admin running a diagnostic tool makes this an insider/post-compromise escalation path rather than a mass-exploitable flaw. Patch promptly within normal maintenance windows, prioritizing servers where untrusted users hold shell accounts. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged but authorized shell account on the Asterisk server writes a malicious Python file to the fixed world-writable path (/tmp/.ast_tsconvert.py). When an administrator later runs the ast_loggrabber diagnostic script as a privileged user, the planted script is executed with those elevated privileges, giving the attacker code execution and escalation. No public exploit identified at time of analysis; exploitation requires the attacker to anticipate or induce the admin's use of the tool. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Local privilege escalation in the Asterisk PBX ast_loggrabber diagnostic script lets an attacker who already holds an interactive shell account on the Asterisk server plant a malicious Python helper in the world-writable /tmp directory, which is then executed if an administrator later runs ast_loggrabber as a user with elevated privileges. Affected builds are Asterisk up to and including 20.20.0, 21.12.2, 22.10.0 and 23.4.0, plus Certified Asterisk up to 20.7-cert10 and 22.8-cert2; fixes are published in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11 and 22.8-cert3. Exploitation is constrained by two preconditions that must both hold - existing authenticated shell access and a privileged manual invocation of the diagnostic script - and there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV) and no EPSS signal supplied in the available data.
RemediationAI
Vendor-released patches are available: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or to Certified Asterisk 20.7-cert11 or 22.8-cert3, as documented in the GitHub security advisory https://github.com/asterisk/asterisk/security/advisories/GHSA-xgj6-2gc5-5x9c and the corresponding release tags; the fix commits (for example https://github.com/asterisk/asterisk/commit/022407ec47adebe27b7ec8bcf5626e5a02fe1551) move the extracted Python helper out of /tmp and into the script's private temporary directory. Because exploitation requires both an existing interactive shell on the Asterisk server and a privileged manual run of ast_loggrabber, interim risk reduction consists of restricting shell access on Asterisk hosts to fully trusted operators (removing shared or multi-tenant login accounts), never invoking ast_loggrabber as root or as any user holding more privilege than required to read the logs, and clearing any existing /tmp/.ast_tsconvert.py before running the diagnostic - noting that these are compensating measures only and the upstream code change is the complete fix. Patching is not urgent on an emergency timeline (decision label: this_month) but should be scheduled, particularly on deployments where untrusted users can log in to the PBX host.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-426, Untrusted Search Path: contrib/scripts/ast_loggrabber embeds a Python timestamp-conversion helper at the end of its own body and extracts it at runtime with install -m 0600 /dev/stdin /tmp/.ast_tsconvert.py, then pipes Asterisk log files through python /tmp/.ast_tsconvert.py. Because the helper is loaded from a fixed, predictable filename inside the world-writable /tmp directory instead of a directory the invoking user controls exclusively, an attacker with an existing shell session on the host can influence the code that runs in the administrator's elevated context. The upstream fix, visible in the referenced commits, relocates the helper to the script's own private $tmpdir (install -m 0600 /dev/stdin "$tmpdir/.ast_tsconvert.py") and narrows the EXIT trap to rm -rf $tmpdir, removing the shared /tmp path from the execution chain. The available sources do not describe the precise mechanism by which an attacker-controlled file survives or subverts the extraction step, nor any race or timing requirement; the vulnerable pattern documented is simply that the script is executed from a world-writable location. Scoring differs between schemes: CVSS 4.0 gives 6.9 (AV:L/AC:L/AT:P/PR:L/UI:P) while the independent assessment applies CVSS 3.1 AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, both agreeing the vector is local, requires low/authenticated privileges, and has a user-interaction component tied to the administrator running the tool. Impact is scoped as changed (S:C) in the 3.1 assessment, i.e. code runs outside the attacker's original privilege context, with high confidentiality and integrity impact but no availability impact.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Local authorized user (AV:L/PR:L) depending on a privileged admin running the tool (UI:R, AC:H), crossing a privilege boundary (S:C) for code execution (C:H/I:H) with no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, ast_loggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs ast_loggrabber as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB