EUVD-2026-110074Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious phone-provisioning error-page URL
-
DeliveryConvince authenticated AMI user to click link
-
ExploitReflected script executes in victim browser
-
ExecutionExfiltrate AMI session cookie
-
ImpactImpersonate authorized AMI user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a specific, uncommon stack of enabled features, each disabled by default: the Asterisk HTTP web server must be enabled; the Asterisk Manager Interface (AMI) must be enabled; AMI access via HTTP must be enabled; and the res_phoneprov module must be enabled. The attacker must additionally be able to connect to the HTTP server, which binds only to 127.0.0.1 by default even when enabled - so remote reach normally requires local access or a non-default bind-address configuration. Finally, exploitation requires convincing an authorized (authenticated) AMI user to click a malicious link (UI:P). The specific trigger is attacker-controlled text reflected unescaped into phone-provisioning HTTP error pages. These combined limiting factors - multiple non-default modules, the localhost-only binding, and required victim interaction - sharply constrain realistic exploitability. |
| Impact | This is a genuinely low-priority issue despite being a network-vector, unauthenticated-attacker XSS, and the signals are consistent rather than conflicting. The CVSS 4.0 base score is 2.3 (AV:N/AC:L/AT:P/PR:N/UI:P), and the low score is driven by two real constraints encoded in the vector: AT:P (a present attack requirement) and UI:P (passive user interaction). The attack requirement reflects the advisory's statement that the HTTP server binds only to 127.0.0.1 by default even when enabled, so a remote attacker generally cannot reach it without either local access or a non-default bind-address reconfiguration. The vuln.today decision label is 'monitor' (not act_now/emergency), which agrees with the low score. No EPSS score and no KEV listing were provided in the input; absence of these is not evidence either way, but there is no indication of active exploitation. Exploitation status: no public exploit identified at time of analysis - the only GitHub references supplied are the GHSA advisory, the fix commits, and release tags, none of which is PoC or working exploit code. The compounding preconditions (five separate features, all disabled by default, plus required victim interaction) mean this is a high-CVSS-shaped class of bug (reflected XSS) that in practice carries low real-world risk for the vast majority of deployments. |
| Exploit ScenarioDerived | In an environment where Asterisk's HTTP server, AMI, AMI-over-HTTP, and res_phoneprov are all explicitly enabled and the attacker can reach the HTTP listener (which binds to 127.0.0.1 by default), the attacker crafts a malicious link to a phone-provisioning HTTP error page that reflects attacker-controlled, unescaped text. The attacker convinces an authenticated AMI user to click it, and the injected script executes in the victim's browser to steal the AMI session cookie, letting the attacker impersonate that user. No public exploit code was identified in the provided data; only the fix commits and advisory are referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Reflected cross-site scripting in Asterisk's phone-provisioning HTTP error pages (res_phoneprov) lets an unauthenticated attacker who can reach the web server reflect attacker-controlled text into a response and, if an authorized AMI user clicks the crafted link, read that user's AMI session cookie and impersonate them over the HTTP manager interface. Fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 and 22.8-cert3; the CVSS 4.0 score is 2.3 and the vector requires AT:P plus UI:P, so exploitation needs a deliberately configured stack (HTTP server, AMI, AMI-over-HTTP and res_phoneprov all enabled, all off by default) and normally a non-default bind address, since the HTTP server listens on 127.0.0.1 by default. No public exploit code or active exploitation has been identified at time of analysis, and priority is assessed as monitor.
RemediationAI
Vendor-released patch: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or to Certified Asterisk 20.7-cert11 or 22.8-cert3; the release tags and the upstream commits (for example https://github.com/asterisk/asterisk/commit/4373f8174bf71c467fc9db96036126d30425b9e8, which adds ast_xml_escape() to ast_http_create_response(), plus the companion commits referenced from https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp) contain the fix. Because the vendor advisory frames the vulnerable state as a stack of non-default features, the practical compensating controls are to leave the Asterisk HTTP server disabled, to leave the Asterisk Manager Interface disabled, to leave AMI access via HTTP disabled, and to leave res_phoneprov disabled on any system that cannot be patched immediately - noting that disabling res_phoneprov removes automated phone provisioning, and disabling AMI-over-HTTP forces AMI management onto other access paths. If the HTTP server must stay enabled, keeping its default 127.0.0.1 bind address (rather than binding to a routable interface) limits who can deliver the reflected payload. Applying the release for the branch in use is the complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (improper neutralization of input during web page generation) in Asterisk's HTTP layer, specifically the shared response builder ast_http_create_response() in main/http.c, which formatted caller-supplied status text directly into generated HTML error pages. The upstream fix adds a 512-byte escaped_text buffer and routes the text through ast_xml_escape() before formatting, so the reflected string can no longer break out into markup or script. The reachable path is the res_phoneprov module, which serves phone provisioning content over the Asterisk built-in HTTP server; when that server, the Asterisk Manager Interface, and AMI access over HTTP are all enabled, an AMI login over HTTP sets a session cookie that JavaScript running in the reflected page can read. The CPE records identify the affected packages as asterisk and certified-asterisk, and the vendor advisory (GHSA-4pgv-j3mr-3rcp) enumerates six vulnerable branches: asterisk <= 20.20.0, <= 21.12.2, <= 22.10.0, <= 23.4.0, and certified-asterisk <= 20.7-cert10 and <= 22.8-cert2. The trigger is attacker-controlled text reflected unescaped into phone-provisioning HTTP error pages; the CVSS metrics describe severity and preconditions, not a timing or memory-safety mechanism.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Reflected XSS by an unauthenticated attacker, but default localhost-only binding plus non-default module stack make it AC:H, victim click gives UI:R, and cross-context cookie theft/AMI impersonation yields S:C with limited C/I/A.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an authorized user's AMI session cookie and impersonate that user when res_phoneprov is enabled. The Asterisk HTTP web server, Asterisk Manager Interface (AMI), and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to 127.0.0.1 by default even when enabled, and must convince the authorized user to click a malicious link. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB