Asterisk EUVD-2026-111394

Three specific preconditions must all hold: (1) the Asterisk HTTP web server must be explicitly enabled - it is disabled by default; (2) the attacker must be able to reach that HTTP server - by default it binds only to 127.0.0.1, so remote reachability requires a non-default bind address or a proxy/forward; and (3) the attacker must already possess valid read-only ARI (Asterisk REST Interface) credentials and use the REST-over-WebSocket feature. The flaw is that the WebSocket request path did not re-apply the read-only authorization constraints, letting a read-only principal perform write operations including arbitrary module path loading. Limiting factors: default-off HTTP, localhost-only default binding, mandatory valid credentials, and the 'under certain conditions' qualifier captured as high attack complexity - together these substantially narrow realistic exploitation to deployments that expose ARI over HTTP to accounts the operator considers low-privilege.

This is a genuine but conditionally-gated risk rather than an internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5 High) tells a consistent story: network reachable, but high attack complexity (AC:H) and low-but-nonzero privileges (PR:L) are required, culminating in full confidentiality/integrity/availability loss via arbitrary module path loading and conditional RCE. The vuln.today decision label is 'this_week', which aligns with a serious-but-not-drop-everything posture. No EPSS score, no CISA KEV listing, and no public exploit reference were supplied - so exploitation status is 'no public exploit identified at time of analysis'; the GitHub links are vendor patch commits and the GHSA advisory, not proof-of-concept code. The signals are largely concordant: a high-impact authorization bypass whose real-world reach is throttled by three stacked preconditions (HTTP enabled, reachable, and valid read-only ARI credentials). The main caveat is the PR:L rating - it assumes the attacker already holds valid read-only ARI credentials, so this is primarily an privilege-escalation/authorization-bypass risk for environments that hand out scoped ARI accounts, not an anonymous remote RCE. Given HTTP is off by default and bound to 127.0.0.1, blanket internet exposure is unlikely unless an operator has deliberately widened the bind address and provisioned low-privilege ARI users.

An attacker holding valid read-only ARI credentials (for example a monitoring or integration account) connects to a reachable, HTTP-enabled Asterisk instance and opens a REST-over-WebSocket session. Because the WebSocket request path failed to re-apply the read-only authorization checks, the attacker issues write operations they should not be permitted, including loading an arbitrary module path to achieve conditional remote code execution. No public exploit code was identified in the provided data; the high attack complexity (AC:H) reflects the 'under certain conditions' qualifier in the advisory.