CVE-2024-57520: Critical severity asterisk vulnerability
Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the actioncreateconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory (aka directory traversal) and the attack can only be performed by a privileged user who has the ability to manage the configuration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57520?
CVE-2024-57520 is categorized as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2024-57520?
To fix CVE-2024-57520, users should update their Asterisk software to the latest patched version provided by the vendor.
What is the impact of CVE-2024-57520?
The impact of CVE-2024-57520 allows an attacker to execute arbitrary code on affected Asterisk systems.
Which versions of Asterisk are affected by CVE-2024-57520?
CVE-2024-57520 specifically affects Asterisk version 22.
Is CVE-2024-57520 exploitable remotely?
Yes, CVE-2024-57520 can be exploited remotely due to insecure permissions in the action_createconfig function.