DEBIAN-CVE-2026-57202: High severity debian/asterisk vulnerability

Q: Which deployments are realistically exposed?

An instance is exposed only if its HTTP web server is enabled and reachable and an attacker has valid read-only ARI credentials. HTTP is disabled by default, and when enabled it binds to 127.0.0.1 by default, limiting exposure unless it has been configured to be reachable.

Q: What can a read-only ARI user do through this flaw?

A read-only ARI user may invoke setChannelVar to execute write dialplan functions, including FILE() writes. This bypass is possible even when live_dangerously is set to no in asterisk.conf.

Q: What versions contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1. For Certified Asterisk, it is fixed in 20.7-cert11 and 22.8-cert3.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when livedangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 27, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed?

An instance is exposed only if its HTTP web server is enabled and reachable and an attacker has valid read-only ARI credentials. HTTP is disabled by default, and when enabled it binds to 127.0.0.1 by default, limiting exposure unless it has been configured to be reachable.

What can a read-only ARI user do through this flaw?

A read-only ARI user may invoke setChannelVar to execute write dialplan functions, including FILE() writes. This bypass is possible even when live_dangerously is set to no in asterisk.conf.

What versions contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1. For Certified Asterisk, it is fixed in 20.7-cert11 and 22.8-cert3.

DEBIAN-CVE-2026-57202: High severity debian/asterisk vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What can a read-only ARI user do through this flaw?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What can a read-only ARI user do through this flaw?

What versions contain the fix?