Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-57200— Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE

Quick assessment

Affected

asterisk asterisk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一款开源的专用小交换机（PBX）和电话工具包。在以下版本之前：Asterisk 20.20.1、21.12.3、22.10.1、23.4.1 以及 Certified Asterisk 22.8-cert3，若攻击者已拥有的只读权限，则在特定条件下，可能通过执行写操作。该权限绕过漏洞允许加载“任意模块路径”，并可能导致条件性的远程代码执行。此漏洞的利用需要满足以下条件：Asterisk 的 HTTP Web 服务器必须已启用且可访问，且攻击者必须已持有有效的“只读 ARI 凭据”。默认情况下

CVSS 7.5 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1068.001 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE

Source: CVE Program / CVE List V5

Vulnerability Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
asterisk	asterisk	< 20.20.1	-
certified-asterisk	certified-asterisk	>= 22.8-cert1-pre1, < 22.8-cert3	-

II. Public POCs for CVE-2026-57200

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57200

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57200 (6)

🔗 GitHub - asterisk/asterisk at 24.0.0-pre1 · GitHub x_refsource_MISC
🔗 Release Asterisk Release 23.4.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 21.12.3 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 20.20.1 · asterisk/asterisk · GitHub Read full article x_refsource_MISC
🔗 Release Asterisk Release 22.10.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release certified-22.8-cert3 · asterisk/asterisk · GitHub x_refsource_MISC

Other References for CVE-2026-57200 (7)

https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c x_refsource_CONFIRM
https://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a x_refsource_MISC
https://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-57200

Same Patch Batch · asterisk · 2026-10-27 · 16 CVEs total

CVE-2026-57191	8.2 HIGH	Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
CVE-2026-57202	8.1 HIGH	Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57197	7.7 HIGH	Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57201	7.5 HIGH	Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57195	7.5 HIGH	Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
CVE-2026-57186	7.5 HIGH	Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
CVE-2026-57188	7.1 HIGH	Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57190	7.0 HIGH	Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
CVE-2026-57203	6.9 MEDIUM	Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper locati
CVE-2026-57185	6.5 MEDIUM	Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57192	6.0 MEDIUM	Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
CVE-2026-57194	5.9 MEDIUM	Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57198	2.3 LOW	Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57189	2.3 LOW	Asterisk: Possible RED T.140 Generation Accumulation OOB Write
CVE-2026-57199	2.3 LOW	Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct

IV. Related Vulnerabilities

Same product: asterisk

Same vendor: asterisk

Same weakness: CWE-22