Live › vulnerability › CVE-2026-57202
Go to dashboardAsterisk's REST Interface lets a user with read-only ARI credentials call setChannelVar to run write dialplan functions, including FILE() writes, even when live_dangerously is set to no. An attacker who holds those credentials can write files on the Asterisk host, which can lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:33 UTC. All times on this page are UTC.
Only deployments with the Asterisk HTTP server and ARI enabled and reachable, where an attacker already holds valid read-only ARI credentials. HTTP is disabled by default and binds to 127.0.0.1 by default, so default installs are not reachable from the network. Teams that run Asterisk with ARI off or bound to localhost can skip it.
No product ranges from the sources yet.
asterisk -V to read the installed version.asterisk.conf for live_dangerously, and check whether the HTTP server is enabled in http.conf and bound to a reachable address.ari.conf for read-only ARI users.20.20.1, 21.12.3, 22.10.1 or 23.4.1.20.7-cert11 or 22.8-cert3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when live_dangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57202")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.