Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0044.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
asterisk asterisk affected
Version Status Constraints
< 20.20.1 affected —
>= 21.0.0-pre1, < 21.12.3 affected —
>= 22.0.0-pre1, < 22.10.1 affected —
>= 23.0.0-pre1, < 23.4.1 affected —
asterisk certified-asterisk affected
Version Status Constraints
< 20.7-cert11 affected —
>= 22.8-cert1-pre1, < 22.8-cert3 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Asterisk Subscribe
Asterisk Subscribe
Certified Asterisk Subscribe

Project Subscriptions

Vendors Products
Asterisk Subscribe
Asterisk Subscribe
Certified Asterisk Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66 cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845 cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9 cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/20.20.1 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/21.12.3 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/22.10.1 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/23.4.1 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 cve-icon cve-icon
https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959 cve-icon cve-icon
https://github.com/asterisk/asterisk/tree/24.0.0-pre1 cve-icon cve-icon
History

Wed, 28 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Asterisk
Asterisk asterisk
Asterisk certified Asterisk
Vendors & Products Asterisk
Asterisk asterisk
Asterisk certified Asterisk

Tue, 27 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
Description Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Title Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
Weaknesses CWE-1220
CWE-267
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T16:13:52.414Z

Reserved: 2026-06-24T02:00:46.800Z

Link: CVE-2026-57202

cve-icon Vulnrichment

Updated: 2026-10-28T14:58:18.720Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-27T18:17:37.550

Modified: 2026-10-28T17:18:34.580

Link: CVE-2026-57202

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T21:15:08Z

Weaknesses