CVE-2026-57202: Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when livedangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires the Asterisk HTTP web server to be enabled and reachable, along with valid read-only ARI credentials. HTTP is disabled by default and, when enabled, binds to 127.0.0.1 by default, so instances retaining those defaults are not remotely reachable through HTTP.
What level of access does an attacker need?
An attacker must authenticate to the Asterisk REST Interface using read-only ARI credentials. No user interaction is required, and the attacker can then use setChannelVar to invoke write dialplan functions.
Does setting live_dangerously to no mitigate the issue?
No. The vulnerable setChannelVar behavior permits write dialplan functions, including FILE() writes, despite live_dangerously being set to no.
What versions contain fixes?
Fixes are available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.
What can be done before upgrading?
Limit exposure by ensuring the Asterisk HTTP server is not enabled or reachable by untrusted systems, and protect or restrict read-only ARI credentials. This is particularly important where HTTP has been configured to listen beyond localhost.