CVE-2026-57202
Description
A flaw was found in Asterisk. An authenticated remote attacker with read-only permissions to the Asterisk REST Interface (ARI) can bypass access controls by invoking the setChannelVar function. This vulnerability allows the attacker to execute restricted write operations, such as modifying arbitrary files on the underlying system, resulting in privilege escalation.
Statement
This vulnerability is rated as having an Important severity because authenticated users with restricted read access can elevate their privileges to alter sensitive system resources, leading to potential unauthorized file modification. In typical deployments, exposure is limited because the HTTP interface and REST service are not enabled by default and bind solely to the local loopback address when initially activated. Exploitation is constrained by the prerequisite that an attacker must possess legitimate authentication credentials and the management interface must be exposed across the network.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to inhibit thread escalations during channel variable evaluation in Asterisk REST Interface setChannelVar processing to block dangerous dialplan functions: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified 20.7-cert11, 22.8-cert3 (or the fixed Asterisk builds), which enable thread escalation inhibition via ast_thread_inhibit_escalations_swap before calling pbx_builtin_setvar_helper in app_control_set_channel_var and restore previous state afterwards, closing invocation of dangerous dialplan functions through ARI setChannelVar variable names or values. Until patched, this is only a concern on Asterisk deployments with the HTTP web server enabled and network-accessible where clients hold read-only Asterisk REST Interface credentials — Deployments where the Asterisk HTTP web server is disabled or restricted to local loopback access are unaffected — so Keep the Asterisk HTTP web server disabled or bound strictly to 127.0.0.1, restrict network access to the Asterisk REST Interface port via firewalls, and audit or revoke unnecessary read-only ARI user credentials. As a compensating measure, Deploy file integrity monitoring such as AIDE to detect unauthorized modifications to critical system files caused by FILE dialplan writes, Restrict Asterisk filesystem write destinations at the application level to prevent arbitrary file modifications if dangerous dialplan functions are executed, Enforce a read-only root filesystem to prevent unauthorized file overwrites across system directories, Isolate the Asterisk daemon from critical system paths by bounding filesystem write permissions using Landlock LSM sandboxing, Enforce read-only root filesystems on containerized Asterisk instances to restrict write operations against host and container paths, and Deploy an endpoint detection and response agent to alert on abnormal file write activity and tampering initiated by the Asterisk process. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing escalation inhibition defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Other
Exposing critical functionality essentially provides an attacker with the privilege level of the exposed functionality. The consequences may vary depending on the behavior of the exposed method. Typically, this could result in the modification or exposure of sensitive data or possibly even execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
