Authentication Bypass in Asterisk Telephony Toolkit
CVE-2026-57202
8.1HIGH
What is CVE-2026-57202?
Asterisk, an open-source telephony toolkit, has identified a vulnerability where an authenticated attacker with read-only privileges could exploit the Asterisk REST Interface (ARI) to perform unauthorized write actions. Through the use of the setChannelVar functionality, attackers could execute dialplan functions like FILE() writes, even if the configuration explicitly prevents such actions. This vulnerability requires the Asterisk HTTP server to be enabled and accessible, with attackers needing valid read-only ARI credentials to exploit it.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1