LDAP Filter Injection Vulnerability in Asterisk Telephony Toolkit
CVE-2026-57193
6.9MEDIUM
What is CVE-2026-57193?
The Asterisk telephony toolkit has a vulnerability in its LDAP realtime driver, 'res_config_ldap', which may permit LDAP filter injection via a crafted SIP username. This allows unauthenticated attackers to perform arbitrary LDAP queries, potentially disclosing sensitive information. It is essential to note that the 'res_config_ldap' module must be loaded and configured for connection to an LDAP server, which is not the default setting. This issue has been addressed in several Asterisk versions, enhancing overall security.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1