Live › vulnerability › CVE-2026-57200
Go to dashboardAsterisk is an open source telephony toolkit (PBX). An attacker with read-only ARI credentials can send write operations over REST-over-WebSocket, bypassing authorization to load an arbitrary module path, which can lead to remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:29 UTC. All times on this page are UTC.
Systems running Asterisk with the HTTP web server enabled and reachable over the network, and with ARI read-only credentials in use. HTTP is disabled by default and binds only to 127.0.0.1 by default, so default installs are not exposed. Teams running only default configurations on a closed network can skip it.
No product ranges from the sources yet.
asterisk -rx "core show version", and compare it against the fixed releases.enabled = yes under [general] in http.conf and for ARI settings in ari.conf.ari.conf.20.20.1, 21.12.3, 22.10.1 or 23.4.1.22.8-cert3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the Asterisk REST Interface (ARI) may, under certain conditions, execute write operations through REST-over-WebSocket. The authorization bypass permits arbitrary module path loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57200")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.