CVE-2026-57200
Description
A flaw was found in Asterisk. This vulnerability allows an authenticated remote attacker with read-only permissions to achieve arbitrary code execution by bypassing authorization controls. Under conditions where the HTTP service is enabled and accessible, an attacker can submit unauthorized write requests through the Asterisk REST Interface (ARI) over WebSocket connections, permitting arbitrary module loading.
Statement
This vulnerability is rated as Important rather than Critical because exploitation requires authenticated read-only access to the Asterisk REST Interface alongside an exposed HTTP interface. If these non-default conditions are satisfied, unauthorized write operations can be issued to load external modules and compromise the host environment. Under default Asterisk configurations, the underlying web service remains inactive or restricted exclusively to the loopback interface, significantly reducing remote exposure.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to bind the Asterisk HTTP service exclusively to localhost (127.0.0.1) to eliminate remote exposure of the Asterisk REST Interface: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified Asterisk 22.8-cert3 (or the fixed Asterisk builds), which forward the initial HTTP GET query parameters into WebSocket REST request processing and append api_key to request queries to enforce read-only user restrictions on non-GET methods, closing all 2 injection vectors (non-GET REST requests over WebSocket authenticated via api_key query parameter, unauthorized module loading via REST-over-WebSocket write requests). Until patched, this is a concern on Asterisk deployments on Linux with the HTTP service enabled and network-accessible, so restrict the Asterisk HTTP service binding to 127.0.0.1, block untrusted network access to ARI ports, and audit or revoke read-only Asterisk REST Interface credentials. As a compensating measure, log file execution and library loading events via auditd to detect unauthorized module loading and foreign binary execution, restrict network access to the Asterisk HTTP and WebSocket port to authorized administrative hosts using host firewalls, confine the Asterisk process using SELinux in enforcing mode to bound damage and prevent code execution from loaded modules, apply an AppArmor profile in enforcing mode to restrict filesystem path access and block loading shared objects from arbitrary paths, block unauthorized write requests and REST-over-WebSocket upgrade paths at a reverse proxy before reaching the Asterisk daemon, and isolate Asterisk telephony and HTTP management interfaces onto separate network zones or VLANs. These controls limit blast radius and contain exploitation, but they do not fix the underlying ARI authorization bypass defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Other
Exposing critical functionality essentially provides an attacker with the privilege level of the exposed functionality. The consequences may vary depending on the behavior of the exposed method. Typically, this could result in the modification or exposure of sensitive data or possibly even execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
