Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 7
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-28 16:13
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-28 17:18
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-28 16:13
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-28 14:22
- StatusReceived → PublishedNVD modified 2026-10-27 17:58
- StatusPublished → ReceivedNVD modified 2026-10-27 18:17
- First seenCVSS 8.1 · asteriskNVD modified 2026-10-27 17:58
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 15
- https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f
- https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb
- https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a
- https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66
- https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845
- https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9
- https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928
- https://github.com/asterisk/asterisk/releases/tag/20.20.1
- https://github.com/asterisk/asterisk/releases/tag/21.12.3
- https://github.com/asterisk/asterisk/releases/tag/22.10.1
- https://github.com/asterisk/asterisk/releases/tag/23.4.1
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
- https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1