Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57202— Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

Quick assessment

Affected
asterisk asterisk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一个开源的专用交换机（PBX）和电话工具包。在 Asterisk 20.20.1、21.12.3、22.10.1、23.4.1 以及认证版 Asterisk 20.7-cert11、22.8-cert3 之前，拥有只读权限的已认证 Asterisk REST 接口（ARI）攻击者，可利用 命令执行写操作相关的拨号计划函数（包括 写操作），即使 中的 参数已设置为 。该漏洞利用的前提是 Asterisk 的 HTTP Web 服务器必须处于启用状态并可被访问，且攻击者必须已持有有效的“只读 ARI

CVSS 8.1 · High

Affected Version Matrix 6

VendorProduct Version RangeStatus
asterisk asterisk < 20.20.1 affected
>= 21.0.0-pre1, < 21.12.3 affected
>= 22.0.0-pre1, < 22.10.1 affected
>= 23.0.0-pre1, < 23.4.1 affected
asterisk certified-asterisk < 20.7-cert11 affected
>= 22.8-cert1-pre1, < 22.8-cert3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57202

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
Source: CVE Program / CVE List V5
Vulnerability Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权定义了不安全动作
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
asterisk asterisk < 20.20.1 -
asterisk certified-asterisk < 20.7-cert11 -

II. Public POCs for CVE-2026-57202

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57202

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57202 (7)

Other References for CVE-2026-57202 (8)

Same Patch Batch · asterisk · 2026-10-27 · 8 CVEs total

CVE-2026-57197 7.7 HIGH Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57201 7.5 HIGH Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57188 7.1 HIGH Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57185 6.5 MEDIUM Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57194 5.9 MEDIUM Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57198 2.3 LOW Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57189 2.3 LOW Asterisk: Possible RED T.140 Generation Accumulation OOB Write

IV. Related Vulnerabilities

Same product: asterisk
Same vendor: asterisk
Same weakness: CWE-267