Arbitrary Code Execution Vulnerability in Asterisk Telephony Toolkit
CVE-2026-23741
NONE
What is CVE-2026-23741?
Asterisk, a prominent open-source telephony toolkit, contains a vulnerability in the ast_coredumper script that runs as a root user, allowing attackers with write access to /etc/asterisk/ast_debug_tools.conf to execute arbitrary bash code. This occurs due to the script's design, which sources configurations from this file that can be maliciously altered. Mitigations are provided in the recent patches, requiring users to upgrade to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2 to protect against potential exploitation.
Affected Version(s)
asterisk < 23.2.2 < 23.2.2
asterisk < 22.8.2 < 22.8.2
asterisk < 21.12.1 < 21.12.1