EUVD-2026-110081Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SIP service on vulnerable Asterisk
-
DeliveryCraft SIP username with LDAP filter metacharacters
-
Exploitres_config_ldap builds unescaped LDAP filter
-
ExecutionArbitrary LDAP query executed against directory
-
ImpactDisclose sensitive LDAP information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Exploitation requires that the res_config_ldap realtime driver module be both loaded and configured to query a backend LDAP server - the advisory explicitly states this is NOT the default configuration, so only Asterisk deployments using LDAP realtime are exposed. Given that configuration, no authentication is required (PR:N): the attacker only needs to send crafted SIP packets whose SIP username carries LDAP filter metacharacters ( * ( ) \ ) that the module inserts into the LDAP filter without RFC 4515 escaping. The limiting factors are therefore the non-default LDAP-realtime deployment mode and the confidentiality-only impact (arbitrary LDAP read/disclosure, no modification or service disruption described); affected versions are those below Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. |
| Impact | Signals are moderate and broadly consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated trigger, but the vulnerable-system impact is confidentiality-only and limited (VC:L, VI:N, VA:N), yielding a MEDIUM 6.9 - this is information disclosure, not code execution or integrity/availability loss. EPSS is 1.96% (80th percentile), which is elevated relative to the average CVE but far from high-probability, and there is NO CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), matching a patch-promptly rather than drop-everything posture. The single most important mitigating factor is that the attack surface is NOT present in default deployments: it requires the res_config_ldap module to be loaded and configured against an LDAP server. So although the raw vector reads as 'unauthenticated network', real-world exposure is confined to the subset of Asterisk installations using the LDAP realtime driver - this is a genuine but scoped priority, not a high-CVSS-but-illusory issue, and also not a widespread-internet-exposure emergency. |
| Exploit ScenarioDerived | An Asterisk PBX is configured to use the res_config_ldap realtime driver against a corporate LDAP directory. A remote, unauthenticated attacker sends crafted SIP packets whose SIP username field contains LDAP filter metacharacters, which res_config_ldap inserts unescaped into the LDAP query, letting the attacker alter the filter and read directory data they should not see. No public exploit code is identified at time of analysis, though the fixing commit publicly reveals the unescaped filter-construction path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
LDAP filter injection in the res_config_ldap realtime driver of Asterisk (before 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk before 20.7-cert11 and 22.8-cert3) allows remote unauthenticated attackers to place LDAP filter metacharacters into the SIP username field, which the module splices into backend LDAP filters without RFC 4515 escaping, letting them issue arbitrary directory queries and disclose information. Exposure is limited to deployments where res_config_ldap is both loaded and configured against an LDAP server - a non-default configuration per the vendor advisory - and impact is confidentiality-only, with no modification or denial of service described. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is roughly 2% (80th percentile), consistent with the configuration precondition rather than a broadly weaponizable flaw.
RemediationAI
Upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or to Certified Asterisk 20.7-cert11 or 22.8-cert3, per the vendor releases at https://github.com/asterisk/asterisk/releases/tag/20.20.1, https://github.com/asterisk/asterisk/releases/tag/21.12.3, https://github.com/asterisk/asterisk/releases/tag/22.10.1, https://github.com/asterisk/asterisk/releases/tag/23.4.1, https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 and https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3; the escaping fix can be reviewed in the upstream commits referenced by advisory GHSA-r6c2-hwc2-j4mp for backporting to unsupported builds. Where upgrading is not immediately possible, the exposure is defined by the two vendor preconditions: unload res_config_ldap (or refrain from loading it) on systems that do not need directory-backed realtime configuration, with the trade-off that any realtime-sourced endpoints, configuration objects or SIP peers served from LDAP will no longer resolve and must fall back to static or other realtime backends; or, if LDAP realtime is genuinely required, restrict LDAP realtime use to deployments where query results cannot expose sensitive directory content and tighten the bind account's read permissions to the minimum subtree and attributes Asterisk needs, accepting that this limits blast radius rather than removing the injection. Note that the upstream fix does not escape values on the LIKE query path, so filtering assumptions on that path should not be treated as hardened even after upgrade; the vendor's complete fix is the patched release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Asterisk is an open source PBX and telephony toolkit, and res_config_ldap is its LDAP-backed realtime configuration driver, which lets the PBX source configuration objects (including SIP/endpoint records) directly from an LDAP directory instead of static files. The flaw is CWE-943 (improper neutralization of special elements in data query logic): the function append_var_and_value_to_filter() built LDAP search filters by concatenating attribute names and caller-supplied values directly, so input reaching it through a SIP username could carry the RFC 4515 metacharacters * (asterisk/wildcard), ( and ) (filter delimiters) and \ (escape character). By injecting these, an attacker can terminate or reshape the filter the driver sends to the directory server, steering the query toward entries and attributes not intended to be reachable and exfiltrating the results through the resulting behaviour. The upstream fix adds an ldap_filter_escape_value() helper that rewrites *, (, ) and \ as \2a, \28, \29 and \5c before values are appended to the filter; notably, the commit comment states the LIKE path deliberately preserves the original wildcard behaviour and that more comprehensive escaping there is left to maintainers, so the fix is scoped to the non-LIKE branch. Escaping is applied per value, so correctness depends on the patched code path being the one used by the configured queries.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated SIP trigger (AV:N/AC:L/PR:N/UI:N); limited directory information disclosure only, so C:L with I:N/A:N and S:U.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver res_config_ldap may permit LDAP filter injection through a SIP username, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The res_config_ldap module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB